[PATCH] mac80211: fix invalid band deref building preq IEs

[PATCH] mac80211: fix invalid band deref building preq IEs

[Arik Nemtsov]

The function building probe-request IEs does not validate the band is
supported before dereferencing it. This can result in a panic when
all bands are traversed, as done during sched-scan start.

Warn when this happens and return an empty probe request. Also fix
sched-scan to not waste memory on unsupported bands.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
---
This is not cc stable since the panic only started happening once
the 60Ghz band was added. Apparently all sched-scan drivers supported
all possible bands until then.


 net/mac80211/scan.c |    3 +++
 net/mac80211/util.c |    2 ++
 2 files changed, 5 insertions(+)

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 379f178..1ff04f6 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -928,6 +928,9 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
 	}
 
 	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+		if (!local->hw.wiphy->bands[i])
+			continue;
+
 		local->sched_scan_ies.ie[i] = kzalloc(2 +
 						      IEEE80211_MAX_SSID_LEN +
 						      local->scan_ies_len +
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 64493a7..503412a 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -999,6 +999,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
 	int ext_rates_len;
 
 	sband = local->hw.wiphy->bands[band];
+	if (!WARN_ON_ONCE(sband))
+		return 0;
 
 	pos = buffer;
 
-- 
1.7.9.5

Re: [PATCH] mac80211: fix invalid band deref building preq IEs

[Johannes Berg]

On Mon, 2012-07-09 at 19:49 +0300, Arik Nemtsov wrote:
> The function building probe-request IEs does not validate the band is
> supported before dereferencing it. This can result in a panic when
> all bands are traversed, as done during sched-scan start.
> 
> Warn when this happens and return an empty probe request. Also fix
> sched-scan to not waste memory on unsupported bands.
> 
> Signed-off-by: Arik Nemtsov <arik@wizery.com>
> ---
> This is not cc stable since the panic only started happening once
> the 60Ghz band was added. Apparently all sched-scan drivers supported
> all possible bands until then.
> 
> 
>  net/mac80211/scan.c |    3 +++
>  net/mac80211/util.c |    2 ++
>  2 files changed, 5 insertions(+)
> 
> diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
> index 379f178..1ff04f6 100644
> --- a/net/mac80211/scan.c
> +++ b/net/mac80211/scan.c
> @@ -928,6 +928,9 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
>  	}
>  
>  	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
> +		if (!local->hw.wiphy->bands[i])
> +			continue;
> +
>  		local->sched_scan_ies.ie[i] = kzalloc(2 +
>  						      IEEE80211_MAX_SSID_LEN +
>  						      local->scan_ies_len +
> diff --git a/net/mac80211/util.c b/net/mac80211/util.c
> index 64493a7..503412a 100644
> --- a/net/mac80211/util.c
> +++ b/net/mac80211/util.c
> @@ -999,6 +999,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
>  	int ext_rates_len;
>  
>  	sband = local->hw.wiphy->bands[band];
> +	if (!WARN_ON_ONCE(sband))
> +		return 0;

That's not right :-)

johannes

Re: [PATCH] mac80211: fix invalid band deref building preq IEs

[Arik Nemtsov]

On Mon, Jul 9, 2012 at 7:54 PM, Johannes Berg <johannes@sipsolutions.net> wrote:
> On Mon, 2012-07-09 at 19:49 +0300, Arik Nemtsov wrote:
>> The function building probe-request IEs does not validate the band is
>> supported before dereferencing it. This can result in a panic when
>> all bands are traversed, as done during sched-scan start.
>>
>> Warn when this happens and return an empty probe request. Also fix
>> sched-scan to not waste memory on unsupported bands.
>>
>> Signed-off-by: Arik Nemtsov <arik@wizery.com>
>> ---
>> This is not cc stable since the panic only started happening once
>> the 60Ghz band was added. Apparently all sched-scan drivers supported
>> all possible bands until then.
>>
>>
>>  net/mac80211/scan.c |    3 +++
>>  net/mac80211/util.c |    2 ++
>>  2 files changed, 5 insertions(+)
>>
>> diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
>> index 379f178..1ff04f6 100644
>> --- a/net/mac80211/scan.c
>> +++ b/net/mac80211/scan.c
>> @@ -928,6 +928,9 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
>>       }
>>
>>       for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
>> +             if (!local->hw.wiphy->bands[i])
>> +                     continue;
>> +
>>               local->sched_scan_ies.ie[i] = kzalloc(2 +
>>                                                     IEEE80211_MAX_SSID_LEN +
>>                                                     local->scan_ies_len +
>> diff --git a/net/mac80211/util.c b/net/mac80211/util.c
>> index 64493a7..503412a 100644
>> --- a/net/mac80211/util.c
>> +++ b/net/mac80211/util.c
>> @@ -999,6 +999,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
>>       int ext_rates_len;
>>
>>       sband = local->hw.wiphy->bands[band];
>> +     if (!WARN_ON_ONCE(sband))
>> +             return 0;
>
> That's not right :-)

heh. yea I guess I didn't test it with the WARN_ON :)