2011-08-11 01:00:56

by Felix Fietkau

Subject: [PATCH] cfg80211: fix a crash in nl80211_send_station

mac80211 leaves sinfo->assoc_req_ies uninitialized, causing a random
pointer memory access in nl80211_send_station.
Instead of checking if the pointer is null, use sinfo->filled, like
the rest of the fields.

Signed-off-by: Felix Fietkau <[email protected]>
---
include/net/cfg80211.h | 4 +++-
net/wireless/nl80211.c | 2 +-
2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 779e300..96876d3 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -421,6 +421,7 @@ struct station_parameters {
* @STATION_INFO_RX_BITRATE: @rxrate fields are filled
* @STATION_INFO_BSS_PARAM: @bss_param filled
* @STATION_INFO_CONNECTED_TIME: @connected_time filled
+ * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
*/
enum station_info_flags {
STATION_INFO_INACTIVE_TIME = 1<<0,
@@ -439,7 +440,8 @@ enum station_info_flags {
STATION_INFO_SIGNAL_AVG = 1<<13,
STATION_INFO_RX_BITRATE = 1<<14,
STATION_INFO_BSS_PARAM = 1<<15,
- STATION_INFO_CONNECTED_TIME = 1<<16
+ STATION_INFO_CONNECTED_TIME = 1<<16,
+ STATION_INFO_ASSOC_REQ_IES = 1<<17
};

/**
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index ca76977..253e563 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2236,7 +2236,7 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
}
nla_nest_end(msg, sinfoattr);

- if (sinfo->assoc_req_ies)
+ if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
sinfo->assoc_req_ies);

--
1.7.3.2

2011-08-11 21:38:15

by Larry Finger

Subject: Re: [PATCH] cfg80211: fix a crash in nl80211_send_station

On 08/10/2011 08:00 PM, Felix Fietkau wrote:
> mac80211 leaves sinfo->assoc_req_ies uninitialized, causing a random
> pointer memory access in nl80211_send_station.
> Instead of checking if the pointer is null, use sinfo->filled, like
> the rest of the fields.
>
> Signed-off-by: Felix Fietkau<[email protected]>

John,

I hope this patch will be added to wireless-testing soon. It is particularly
insidious as it leads to kernel panics or spontaneous reboots. Note: the problem
occurs even when the NIC is not being used as an AP.

Thanks,

Larry

2011-08-11 08:15:57

by Jouni Malinen

Subject: Re: [PATCH] cfg80211: fix a crash in nl80211_send_station

On Wed, Aug 10, 2011 at 07:00:33PM -0600, Felix Fietkau wrote:
> mac80211 leaves sinfo->assoc_req_ies uninitialized, causing a random
> pointer memory access in nl80211_send_station.
> Instead of checking if the pointer is null, use sinfo->filled, like
> the rest of the fields.

Thanks! This was too easy a trap to fall into.. It looked obvious that
sinfo would be cleared before calls, but clearly not (well, it was
cleared in the driver that I used for testing this ;-). I'll see if an
additional patch could be added to make this less likely to happen
again.

--
Jouni Malinen PGP id EFC895FA