[PATCH] mac80211: fix tx->skb NULL pointer dereference

[PATCH] mac80211: fix tx->skb NULL pointer dereference

[Yoni Divinsky]

In function ieee80211_tx_h_encrypt the var info was
initialized from tx->skb, since the fucntion
is called after the function ieee80211_tx_h_fragment
tx->skb is not valid anymore.

Signed-off-by: Yoni Divinsky <yoni.divinsky@ti.com>
---
 net/mac80211/tx.c  |   10 +---------
 net/mac80211/wpa.c |   19 +++++++++++++++++++
 net/mac80211/wpa.h |    2 ++
 3 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index edcd1c7..0a5558a 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1001,8 +1001,6 @@ ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
 {
-	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-
 	if (!tx->key)
 		return TX_CONTINUE;
 
@@ -1017,13 +1015,7 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
 	case WLAN_CIPHER_SUITE_AES_CMAC:
 		return ieee80211_crypto_aes_cmac_encrypt(tx);
 	default:
-		/* handle hw-only algorithm */
-		if (info->control.hw_key) {
-			ieee80211_tx_set_protected(tx);
-			return TX_CONTINUE;
-		}
-		break;
-
+		return ieee80211_crypto_default_encrypt(tx);
 	}
 
 	return TX_DROP;
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 93aab07..3fd65ec 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -643,3 +643,22 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
 
 	return RX_CONTINUE;
 }
+
+ieee80211_tx_result
+ieee80211_crypto_default_encrypt(struct ieee80211_tx_data *tx)
+{
+	struct sk_buff *skb;
+	struct ieee80211_tx_info *info = NULL;
+
+	skb_queue_walk(&tx->skbs, skb) {
+		info  = IEEE80211_SKB_CB(skb);
+
+		/* handle hw-only algorithm */
+		if (info == NULL || !info->control.hw_key)
+			return TX_DROP;
+	}
+
+	ieee80211_tx_set_protected(tx);
+
+	return TX_CONTINUE;
+}
diff --git a/net/mac80211/wpa.h b/net/mac80211/wpa.h
index baba060..9d6001a 100644
--- a/net/mac80211/wpa.h
+++ b/net/mac80211/wpa.h
@@ -32,5 +32,7 @@ ieee80211_tx_result
 ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx);
 ieee80211_rx_result
 ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx);
+ieee80211_tx_result
+ieee80211_crypto_default_encrypt(struct ieee80211_tx_data *tx);
 
 #endif /* WPA_H */
-- 
1.7.0.4

Re: [PATCH] mac80211: fix tx->skb NULL pointer dereference

[Johannes Berg]

On Mon, 2012-01-16 at 11:43 +0200, Yoni Divinsky wrote:
> In function ieee80211_tx_h_encrypt the var info was
> initialized from tx->skb, since the fucntion
> is called after the function ieee80211_tx_h_fragment
> tx->skb is not valid anymore.

Wow, that's quite a while ago, I guess nobody tests WAPI often? :-)

> @@ -1001,8 +1001,6 @@ ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
>  static ieee80211_tx_result debug_noinline
>  ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
>  {
> -	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
> -
>  	if (!tx->key)
>  		return TX_CONTINUE;
>  
> @@ -1017,13 +1015,7 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
>  	case WLAN_CIPHER_SUITE_AES_CMAC:
>  		return ieee80211_crypto_aes_cmac_encrypt(tx);
>  	default:
> -		/* handle hw-only algorithm */
> -		if (info->control.hw_key) {
> -			ieee80211_tx_set_protected(tx);
> -			return TX_CONTINUE;
> -		}
> -		break;
> -
> +		return ieee80211_crypto_default_encrypt(tx);

How about
ieee80211_require_hw_crypto() or something like that?

> +ieee80211_tx_result
> +ieee80211_crypto_default_encrypt(struct ieee80211_tx_data *tx)
> +{
> +	struct sk_buff *skb;
> +	struct ieee80211_tx_info *info = NULL;
> +
> +	skb_queue_walk(&tx->skbs, skb) {
> +		info  = IEEE80211_SKB_CB(skb);
> +
> +		/* handle hw-only algorithm */
> +		if (info == NULL || !info->control.hw_key)
> +			return TX_DROP;

info == NULL can't happen

johannes

Re: [PATCH] mac80211: fix tx->skb NULL pointer dereference

[Divinsky, Yonatan]

On Mon, Jan 16, 2012 at 2:21 PM, Johannes Berg
<johannes@sipsolutions.net> wrote:
> On Mon, 2012-01-16 at 11:43 +0200, Yoni Divinsky wrote:
>> In function ieee80211_tx_h_encrypt the var info was
>> initialized from tx->skb, since the fucntion
>> is called after the function ieee80211_tx_h_fragment
>> tx->skb is not valid anymore.
>
> Wow, that's quite a while ago, I guess nobody tests WAPI often? :-)
Who said anything about WAPI ;-)
>
>> @@ -1001,8 +1001,6 @@ ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
>>  static ieee80211_tx_result debug_noinline
>>  ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
>>  {
>> -     struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
>> -
>>       if (!tx->key)
>>               return TX_CONTINUE;
>>
>> @@ -1017,13 +1015,7 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
>>       case WLAN_CIPHER_SUITE_AES_CMAC:
>>               return ieee80211_crypto_aes_cmac_encrypt(tx);
>>       default:
>> -             /* handle hw-only algorithm */
>> -             if (info->control.hw_key) {
>> -                     ieee80211_tx_set_protected(tx);
>> -                     return TX_CONTINUE;
>> -             }
>> -             break;
>> -
>> +             return ieee80211_crypto_default_encrypt(tx);
>
> How about
> ieee80211_require_hw_crypto() or something like that?
To be consistent with the other encryptions I think it would
be better to use something like: ieee80211_crypto_hw_encrypt(tx)

>
>> +ieee80211_tx_result
>> +ieee80211_crypto_default_encrypt(struct ieee80211_tx_data *tx)
>> +{
>> +     struct sk_buff *skb;
>> +     struct ieee80211_tx_info *info = NULL;
>> +
>> +     skb_queue_walk(&tx->skbs, skb) {
>> +             info  = IEEE80211_SKB_CB(skb);
>> +
>> +             /* handle hw-only algorithm */
>> +             if (info == NULL || !info->control.hw_key)
>> +                     return TX_DROP;
>
> info == NULL can't happen
I agree,

thanks,
Yoni
>
> johannes
>