Received: by 2002:a05:7412:3784:b0:e2:908c:2ebd with SMTP id jk4csp999952rdb; Sun, 1 Oct 2023 15:14:56 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGpl9Wj2Q7kYtz5QOcKTy/Q7sC5XfIq/2wo5BdkJZRJyzvz1DQUyEkI/tWWGyw8fECSB06E X-Received: by 2002:a17:902:ceca:b0:1c7:1eb7:82cd with SMTP id d10-20020a170902ceca00b001c71eb782cdmr13053227plg.60.1696198496261; Sun, 01 Oct 2023 15:14:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1696198496; cv=none; d=google.com; s=arc-20160816; b=S43Gxm1P/fAYMWKO5Z/DoXZ6cBY3IOF5kImWbhFiiFF10JonRL6SGiSQCTXH0nhq/A 07GvzxNSs9xaGocw2eZV5QVmur5hpbBkXPXFrToODl5yWyLuVoZUs4E6GtzCME8SvV4M dnY54f2O5+r2QUkXF/oeJBs0EXCgZ2CCZl0pmODWwrl1CzfyeSILgRcuH9rdGMGhT+SZ aeBkIIgC9LnP1UXg2qQXHfax05br8DY+PnbMKAn+zlADLU1UNdACravsBybxR7ucovm/ zcFKay/iAkbhUiwrliwVwjn/11BJGC5tWE1RVAnBuWhKZ2ENdioxlwGX+9esEi3yn09E C3MA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:to:subject:message-id:date:from:mime-version :dkim-signature; bh=hQu7UTTMEhpbsLfWcYaug4VHPEY1RKA+rGnJ7mjF9Yc=; fh=qW0phhq3fb3oiohK/Mu9j1KY1zyRNiiioKFc5anvatM=; b=Q2il5rsvXvs3M4oMa8yIcg3LkMl9cJr+Lrwb5uVlF9yzcfBJS+o+G3eJiiTCssIbFk 1BPM5478z8KM1L3CmWCE+HczFWQaqxXquvap05cjeTVTFTx6YL+bpWcaQIHqkGBX7kmh xt/M015/jnYJ58kKaDUlAXSJYLa4mhaXW7NZVLwI4wWBvZd1v6RxuwBEbDLeZNJaZ0Xe ucGU/PMak1CFRX0nw+Yyt34daaw8ux/4mL9BEYvXPkovd2Ljap+HlgbKNhFfqITGqhsB gFg65qhZ7NUuHmOQo7vG3IoMEyFofiZseOnj4YhEBDcbZFGD/EyhKi8qcAAVKeRouVlJ E0WA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=MhyQlKFB; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from lipwig.vger.email (lipwig.vger.email. [23.128.96.33]) by mx.google.com with ESMTPS id h11-20020a170902680b00b001c3f5db54acsi499620plk.635.2023.10.01.15.14.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Oct 2023 15:14:56 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) client-ip=23.128.96.33; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=MhyQlKFB; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by lipwig.vger.email (Postfix) with ESMTP id C5A69802EF60; Sun, 1 Oct 2023 03:28:29 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at lipwig.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234777AbjJAK2Z (ORCPT + 54 others); Sun, 1 Oct 2023 06:28:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52208 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234768AbjJAK2Y (ORCPT ); Sun, 1 Oct 2023 06:28:24 -0400 Received: from mail-ej1-x636.google.com (mail-ej1-x636.google.com [IPv6:2a00:1450:4864:20::636]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E9C7EBD for ; Sun, 1 Oct 2023 03:28:21 -0700 (PDT) Received: by mail-ej1-x636.google.com with SMTP id a640c23a62f3a-99357737980so2132592366b.2 for ; Sun, 01 Oct 2023 03:28:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1696156100; x=1696760900; darn=vger.kernel.org; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=hQu7UTTMEhpbsLfWcYaug4VHPEY1RKA+rGnJ7mjF9Yc=; b=MhyQlKFBa/z/rSSjCDWFwYbeKR3RGilrBIQe1ghQgj42fJK2eB11NDdsLCq4G5N8YA R2txhbcW7uE/FRciPLH8huVghsx2MdcXJR+GBQy7wPmFVV19k9oVtmjYHA8M1wmhqVS2 8ayWFmnKhsdP+LYChaJmupGnHrxYf9BUbnWga0FVtLTjuBoGrYIDLatB2NpyNtCLea+b G7h9s2XrXVbXyN7FomlkW0i8ktrAqEGIokWDaBJLlfof+FPN7eYSLoYME5DVHw1bnfx0 cmr9hMSj7OBw6JkZm8UPuS1BFtQvQwgPDET/UeHC44cG25ZEMJBfwcXAIuUaMfmmayMI VLGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1696156100; x=1696760900; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=hQu7UTTMEhpbsLfWcYaug4VHPEY1RKA+rGnJ7mjF9Yc=; b=sO53rd4zeSvtKxNr0EFa6/Co4VKaxuR9guRIcOTbwl3rQvDfaazmUgPV03+F5Eswmv Sne+J52BxYsR9UsQ8+89dRhF/LMri6/96tHFkMHYq11/BKTFDreTe0rHfKcJS721uaSv tYM4xtgNVv2YfEtWjQOIMig3zvFqC2RAV2VN0O8CLlvaztRrN98TD3eZj8yZ+aer1lyW 9tf0TpGU1MNgYv0Z8GyDcE65H7++cM7eOzEwnvZa5MbRO1PqwsVgKPwVEBmq2D5kVQwG uru7Y4bXbeWxGfrslhkepg/dbLHnoESFTLE0+mVdS1w1JcMK9ccM19E/Fn7dSq8grv3Y 54xQ== X-Gm-Message-State: AOJu0Yz8qWSkvXhZnd4LQHH5PUADDr2foFDnyDAZdYbK0OnBJ7SGpZVF I4Qio/XgdBpZ+jbxDZtd882zlZVnHW6H3gxDZ7YSUIg6TKlQzg== X-Received: by 2002:a17:906:3150:b0:9b2:babd:cd44 with SMTP id e16-20020a170906315000b009b2babdcd44mr7992150eje.44.1696156100010; Sun, 01 Oct 2023 03:28:20 -0700 (PDT) MIME-Version: 1.0 From: James Dutton Date: Sun, 1 Oct 2023 11:27:44 +0100 Message-ID: Subject: mac80211 bugs To: linux-wireless@vger.kernel.org Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-0.6 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Sun, 01 Oct 2023 03:28:29 -0700 (PDT) Hi, I recently saw a report of a kernel bug that was caused by a null pointer reference in: mac80211.c: sta_set_sinfo() Now, looking at the kernel source code, I can see sta_set_sinfo() dereferencing pointers. The function is a void function, so there is no defensive programming going on in the wifi drivers here. It would seem sensible to try to log a message and return an -EINVAL, rather than crashing/halting the entire kernel, but a void function cannot return anything. Why is there no defensive/security-by-design programming in the Linux wifi drivers? Kind Regards James P.S. The stack trace is here: https://github.com/openwrt/openwrt/issues/13198