Received: by 2002:a05:6358:11c7:b0:104:8066:f915 with SMTP id i7csp6281740rwl; Tue, 4 Apr 2023 10:09:55 -0700 (PDT) X-Google-Smtp-Source: AKy350bbWcx8hWzENp47hXUAS53ddO+8bvUMqP4lHLsOKRC2J+UPDfCjzQLtUfgRwAtc7yzAqhf/ X-Received: by 2002:a50:ff13:0:b0:502:9289:4728 with SMTP id a19-20020a50ff13000000b0050292894728mr166329edu.28.1680628195647; Tue, 04 Apr 2023 10:09:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1680628195; cv=none; d=google.com; s=arc-20160816; b=Pr2O2gNY+IEhZQGjBQUqpAozNx+rNVvqeI7jwISiZx/5jY7+t4lANAi+cqye8VfhX+ iUipsfTPRVr/xEaZOb9n/jImPhRsqCAREdZiRc5Mr+iScPb94kXpcCbT0VHxtf+MQscq GeDYEHuzpGE196/82VQKxKTr+O4WvBXEFQt7h1i9ESAT2KGE9Ec2NNQAHKaXOj1ZNYhW ceSRXy923PDOsXo1yTL1Xz0yn+NJ08vi5UErByvFai8OsgLd6AcWQxpqwcDq2HkpvHHu Mpg+Mfg9AQjdUihPZbTEUnP5RCp5xE/srza2gFqnCa+R6k8m1PhFN8e0BfRnmgNuo01L vsTg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:cc:to:subject :message-id:date:from:in-reply-to:references:mime-version :dkim-signature; bh=EDGnXoGwEChAFRAWjhCsHFaWRtmtPVds+R+V0cWphoI=; b=ESDw+zmEnWTRil7szSGTdKs/GLDhD6PMKvYHn+nfApbjbyzYMxhmViAhozLy352vRP POSVlo3BJPy7cz6sZe+S5NwMcFKPJjfDoisqpf0D0+VJvwoghmY2KO3IXlK4hr4YWcvY /0N0t1T6r89V/K9uwTTf41ORRkMsZ6nEUPwEKuOhhR++84uwB6h+yYv+rxwRnopmGIyW cxW4ITHziCuGceUT/2UtqRa1WbuaiKDhu70ySVwz2kCt2gplSlpQ6OFlTmrFRkAASJZi pO4ZRi3J3/c5QNjOv1jcuHlzC+slRkTVKNez/S1Cpcvy1VxQP2XIlhhOukgPpCI1Gdiu MPsQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b="tGysa/yS"; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id d23-20020a50fb17000000b00502238a3d23si3563406edq.513.2023.04.04.10.09.38; Tue, 04 Apr 2023 10:09:55 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b="tGysa/yS"; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235003AbjDDRBb (ORCPT + 59 others); Tue, 4 Apr 2023 13:01:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49044 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233000AbjDDRBa (ORCPT ); Tue, 4 Apr 2023 13:01:30 -0400 Received: from mail-wr1-x436.google.com (mail-wr1-x436.google.com [IPv6:2a00:1450:4864:20::436]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A579B8 for ; Tue, 4 Apr 2023 10:01:29 -0700 (PDT) Received: by mail-wr1-x436.google.com with SMTP id r11so33525794wrr.12 for ; Tue, 04 Apr 2023 10:01:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; t=1680627687; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=EDGnXoGwEChAFRAWjhCsHFaWRtmtPVds+R+V0cWphoI=; b=tGysa/ySr+aMNbz9i+r+Gzvuh4e9lfJXOuj+yFaOtNFtUxsD3HY0DJYSiv8BFkC6IT XCjdnKCGorzQP1R2a7uORzhp7x8GZARFCEmeVKgPEaLy57UxMZQlBdQL3ymkIX+zsfQb yVazofjpZXNFp+bLzXLbnEl/zVKfIh3+6tbFAcoJJyZscIHQU/kisj5J82z/u0W3esRs riQ1ks6FOD7JmhRsJ9XUtDYGAZ9W831E7C2HHnlZlvPoc/Whno7Jt3VGMQuEOOxMY3pT DqrLs0cKaUFoD1eNjR+fcy46Z3gY5YbWtujQ1DzpKNFGk5trjSTG9lMcbzIodyLmFYfl JlGw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1680627687; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=EDGnXoGwEChAFRAWjhCsHFaWRtmtPVds+R+V0cWphoI=; b=Q/WZt8/isBTmGqKJlejERJ1uexmU57DN5TDaRCGMuMqpSwwCqncCMZcISRSyOFqbi7 BvawKrE/hceuSkNK/aJmHL7f5BjwqIxxneT6IuUUqRxPfuZREenAkCQO+WmSWcpEscs0 qYlNauUAK6GZrbyKw4ouhk/mJ93k1GqX8MDGXDKW57wDUwkVpkhAy5cJQvJ/xNbKoFfe gz5JuBTxO7FislonoDXX40qWQ2zvHnc8yC6WH48L/g7h8FwkvEF5PzMEsyA2b8vE3Hmm 3mpLfrnY6impoA7gk15++t6NbtUwcVeAnznxfX9CK/Ca9gFmSM3OnraT1BY2XJUOrSxQ vhEQ== X-Gm-Message-State: AAQBX9eWFGhvmhxBU7urWZSFWItB8NoPL3f9Oh0QTt0PAp+QBgoEavJ5 SbKSi+lqmO+gRZmcLFNl8mB2p6gPuWneaDUWCi1bvw== X-Received: by 2002:a5d:4601:0:b0:2cf:e70f:970c with SMTP id t1-20020a5d4601000000b002cfe70f970cmr597147wrq.12.1680627687530; Tue, 04 Apr 2023 10:01:27 -0700 (PDT) MIME-Version: 1.0 References: <20230404134803.889673-1-edumazet@google.com> In-Reply-To: From: Eric Dumazet Date: Tue, 4 Apr 2023 19:01:15 +0200 Message-ID: Subject: Re: [PATCH net] mac80211_hwsim: fix potential NULL deref in hwsim_pmsr_report_nl() To: Simon Horman Cc: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Johannes Berg , linux-wireless@vger.kernel.org, netdev@vger.kernel.org, eric.dumazet@gmail.com, syzbot , Jaewan Kim , Johannes Berg Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Spam-Status: No, score=-15.7 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,ENV_AND_HDR_SPF_MATCH, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL, USER_IN_DEF_SPF_WL autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org On Tue, Apr 4, 2023 at 6:18=E2=80=AFPM Simon Horman wrote: > > On Tue, Apr 04, 2023 at 01:48:03PM +0000, Eric Dumazet wrote: > > syzbot reported a NULL deref caused by a missing check > > in hwsim_pmsr_report_nl(), and bisected the issue to cited commit. > > > > Hi Eric, > > I think this is for net-next / wireless-next as > the above mentioned patch does not seem to be in Linus's tree. Oh right, script error on my side. This was generated from -next tree. > > > --- > > drivers/net/wireless/virtual/mac80211_hwsim.c | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/ne= t/wireless/virtual/mac80211_hwsim.c > > index f446d8f6e1f6e1df108db00e898fa02970162585..701e14b8e6fe0cae7ee2478= c8dff0f2327b54a70 100644 > > --- a/drivers/net/wireless/virtual/mac80211_hwsim.c > > +++ b/drivers/net/wireless/virtual/mac80211_hwsim.c > > @@ -3761,6 +3761,8 @@ static int hwsim_pmsr_report_nl(struct sk_buff *m= sg, struct genl_info *info) > > int rem; > > > > src =3D nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]); > > + if (!src) > > + return -EINVAL; > > data =3D get_hwsim_data_ref_from_addr(src); > > if (!data) > > return -EINVAL; > > I could well be wrong, but this looks a little odd given that nla_data is= : > > static inline void *nla_data(const struct nlattr *nla) > { > return (char *) nla + NLA_HDRLEN; > } > > Perhaps we want something like this (*compile tested only!*) ? > > if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]) > return -EINVAL; > src =3D nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]); Oh right, thanks for reviewing this :) I will send a V2 soon.