Re: NULL pointer deref at wext ioctl (Re: [PATCH] compat-2.6: adding ethtool.h to compat-2.6.31.h)

[Johannes Berg <johannes@sipsolutions.net>]

[-- Attachment #1: Type: text/plain, Size: 1104 bytes --]

On Thu, 2009-10-08 at 07:28 +0100, Hin-Tak Leung wrote:

> It looks like it is the 2nd of thes two lines around
> /usr/src/debug/kernel-2.6.30/linux-2.6.30.x86_64/net/wireless/wext.c:448
>  which resulted in the null pointer dereference:
> 
> if (index < dev->wireless_handlers->num_private)
>               return dev->wireless_handlers->private[index];

Ok, that's odd. Is it possible that somehow cfg80211 is picking up an
#ifdef'ed copy of "struct iw_handler_def", and thus the struct it is
defining is simply too small? You can figure that out with debug info,
presumably, but I'm not entirely sure how. Actually maybe nm would tell
you too, if you look for cfg80211_wext_handler.

What I mean is this -- cfg80211 defines cfg80211_wext_handler:

const struct iw_handler_def cfg80211_wext_handler
	.num_standard
	.standard
	.get_wireless_stats

but the core expects
	.num_standard
	.standard
	.num_private
	.num_private_args
	.private
	.private_args
	.get_wireless_stats

as such .num_private ends up non-zero because it's shadowed
by .get_wireles_stats.

johannes

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 801 bytes --]