Re: [PATCH] mac80211_hwsim: Fix NULL pointer dereference

[Johannes Berg <johannes@sipsolutions.net>]

On Thu, 2013-12-05 at 17:53 -0800, Javier Lopez wrote:
> mac80211_hwsim was crashing when receiving tx information from user
> space. Crash happens because txi->rate_driver_data[0] is pointing to a
> non valid memory address.
> 
> This code path is only used by wmediumd and wmediumd doesn't provide
> multiple channel support, so we can update txi->rate_driver_data[0]
> to point to the mac80211_hwsim_data channel information struct
> (data2->channel).
> 
> Signed-off-by: Javier Lopez <jlopex@cozybit.com>
> ---
>  drivers/net/wireless/mac80211_hwsim.c |    1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
> index 9c0cc8d..eddf7bf 100644
> --- a/drivers/net/wireless/mac80211_hwsim.c
> +++ b/drivers/net/wireless/mac80211_hwsim.c
> @@ -2013,6 +2013,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
>  	}
>  
>  	txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
> +	txi->rate_driver_data[0] = data2->channel;

It seems this overwrites status data?
 
>  	if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
>  	   (hwsim_flags & HWSIM_TX_STAT_ACK)) {
...
                if (skb->len >= 16) {
                        hdr = (struct ieee80211_hdr *) skb->data;

mac80211_hwsim_monitor_ack(txi->rate_driver_data[0],
                                                   hdr->addr2);
                }
                txi->flags |= IEEE80211_TX_STAT_ACK;
        }

Since nothing else seems to use the rate_driver_data[0] pointer, it
would be much better to just pass the channel here, no?

johannes