2013-12-06 01:53:40

by Javier Lopez

Subject: [PATCH] mac80211_hwsim: Fix NULL pointer dereference

mac80211_hwsim was crashing when receiving tx information from user
space. Crash happens because txi->rate_driver_data[0] is pointing to a
non valid memory address.

This code path is only used by wmediumd and wmediumd doesn't provide
multiple channel support, so we can update txi->rate_driver_data[0]
to point to the mac80211_hwsim_data channel information struct
(data2->channel).

Signed-off-by: Javier Lopez <[email protected]>
---
drivers/net/wireless/mac80211_hwsim.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 9c0cc8d..eddf7bf 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2013,6 +2013,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
}

txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
+ txi->rate_driver_data[0] = data2->channel;

if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
(hwsim_flags & HWSIM_TX_STAT_ACK)) {
--
1.7.9.5

2013-12-06 08:30:47

by Dani Camps

Subject: Re: [PATCH] mac80211_hwsim: Fix NULL pointer dereference

Hi Javier,

I tested your patch and my problem is now solved.

Thanks!

Daniel



El Viernes 6 de diciembre de 2013 2:53, Javier Lopez <[email protected]> escribi?:
mac80211_hwsim was crashing when receiving tx information from user
space. Crash happens because txi->rate_driver_data[0] is pointing to a
non valid memory address.

This code path is only used by wmediumd and wmediumd doesn't provide
multiple channel support, so we can update txi->rate_driver_data[0]
to point to the mac80211_hwsim_data channel information struct
(data2->channel).

Signed-off-by: Javier Lopez <[email protected]>
---
drivers/net/wireless/mac80211_hwsim.c |? ? 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 9c0cc8d..eddf7bf 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2013,6 +2013,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
??? }

??? txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
+??? txi->rate_driver_data[0] = data2->channel;

??? if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
??? ? (hwsim_flags & HWSIM_TX_STAT_ACK)) {
--
1.7.9.5

2013-12-16 12:50:48

by Johannes Berg

Subject: Re: [PATCH] mac80211_hwsim: Fix NULL pointer dereference

On Thu, 2013-12-05 at 17:53 -0800, Javier Lopez wrote:
> mac80211_hwsim was crashing when receiving tx information from user
> space. Crash happens because txi->rate_driver_data[0] is pointing to a
> non valid memory address.
>
> This code path is only used by wmediumd and wmediumd doesn't provide
> multiple channel support, so we can update txi->rate_driver_data[0]
> to point to the mac80211_hwsim_data channel information struct
> (data2->channel).
>
> Signed-off-by: Javier Lopez <[email protected]>
> ---
> drivers/net/wireless/mac80211_hwsim.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
> index 9c0cc8d..eddf7bf 100644
> --- a/drivers/net/wireless/mac80211_hwsim.c
> +++ b/drivers/net/wireless/mac80211_hwsim.c
> @@ -2013,6 +2013,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
> }
>
> txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
> + txi->rate_driver_data[0] = data2->channel;

It seems this overwrites status data?

> if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
> (hwsim_flags & HWSIM_TX_STAT_ACK)) {
...
if (skb->len >= 16) {
hdr = (struct ieee80211_hdr *) skb->data;

mac80211_hwsim_monitor_ack(txi->rate_driver_data[0],
hdr->addr2);
}
txi->flags |= IEEE80211_TX_STAT_ACK;
}

Since nothing else seems to use the rate_driver_data[0] pointer, it
would be much better to just pass the channel here, no?

johannes