[PATCH] mac80211_hwsim: Fix NULL pointer dereference

[PATCH] mac80211_hwsim: Fix NULL pointer dereference

[Javier Lopez]

mac80211_hwsim was crashing when receiving tx information from user
space. Crash happens because txi->rate_driver_data[0] is pointing to a
non valid memory address.

This code path is only used by wmediumd and wmediumd doesn't provide
multiple channel support, so we can update txi->rate_driver_data[0]
to point to the mac80211_hwsim_data channel information struct
(data2->channel).

Signed-off-by: Javier Lopez <jlopex@cozybit.com>
---
 drivers/net/wireless/mac80211_hwsim.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 9c0cc8d..eddf7bf 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2013,6 +2013,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
 	}
 
 	txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
+	txi->rate_driver_data[0] = data2->channel;
 
 	if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
 	   (hwsim_flags & HWSIM_TX_STAT_ACK)) {
-- 
1.7.9.5

Re: [PATCH] mac80211_hwsim: Fix NULL pointer dereference

[Dani Camps]

Hi Javier,

I tested your patch and my problem is now solved.

Thanks!

Daniel



El Viernes 6 de diciembre de 2013 2:53, Javier Lopez <jlopex@cozybit.com> escribió:
mac80211_hwsim was crashing when receiving tx information from user
space. Crash happens because txi->rate_driver_data[0] is pointing to a
non valid memory address.

This code path is only used by wmediumd and wmediumd doesn't provide
multiple channel support, so we can update txi->rate_driver_data[0]
to point to the mac80211_hwsim_data channel information struct
(data2->channel).

Signed-off-by: Javier Lopez <jlopex@cozybit.com>
---
drivers/net/wireless/mac80211_hwsim.c |    1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 9c0cc8d..eddf7bf 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2013,6 +2013,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
    }

    txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
+    txi->rate_driver_data[0] = data2->channel;

    if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
       (hwsim_flags & HWSIM_TX_STAT_ACK)) {
-- 
1.7.9.5

Re: [PATCH] mac80211_hwsim: Fix NULL pointer dereference

[Johannes Berg]

On Thu, 2013-12-05 at 17:53 -0800, Javier Lopez wrote:
> mac80211_hwsim was crashing when receiving tx information from user
> space. Crash happens because txi->rate_driver_data[0] is pointing to a
> non valid memory address.
> 
> This code path is only used by wmediumd and wmediumd doesn't provide
> multiple channel support, so we can update txi->rate_driver_data[0]
> to point to the mac80211_hwsim_data channel information struct
> (data2->channel).
> 
> Signed-off-by: Javier Lopez <jlopex@cozybit.com>
> ---
>  drivers/net/wireless/mac80211_hwsim.c |    1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
> index 9c0cc8d..eddf7bf 100644
> --- a/drivers/net/wireless/mac80211_hwsim.c
> +++ b/drivers/net/wireless/mac80211_hwsim.c
> @@ -2013,6 +2013,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
>  	}
>  
>  	txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
> +	txi->rate_driver_data[0] = data2->channel;

It seems this overwrites status data?
 
>  	if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
>  	   (hwsim_flags & HWSIM_TX_STAT_ACK)) {
...
                if (skb->len >= 16) {
                        hdr = (struct ieee80211_hdr *) skb->data;

mac80211_hwsim_monitor_ack(txi->rate_driver_data[0],
                                                   hdr->addr2);
                }
                txi->flags |= IEEE80211_TX_STAT_ACK;
        }

Since nothing else seems to use the rate_driver_data[0] pointer, it
would be much better to just pass the channel here, no?

johannes