[PATCH] cfg80211: fix a crash in nl80211_send_station

[PATCH] cfg80211: fix a crash in nl80211_send_station

[Felix Fietkau]

mac80211 leaves sinfo->assoc_req_ies uninitialized, causing a random
pointer memory access in nl80211_send_station.
Instead of checking if the pointer is null, use sinfo->filled, like
the rest of the fields.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
---
 include/net/cfg80211.h |    4 +++-
 net/wireless/nl80211.c |    2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 779e300..96876d3 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -421,6 +421,7 @@ struct station_parameters {
  * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
  * @STATION_INFO_BSS_PARAM: @bss_param filled
  * @STATION_INFO_CONNECTED_TIME: @connected_time filled
+ * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
  */
 enum station_info_flags {
 	STATION_INFO_INACTIVE_TIME	= 1<<0,
@@ -439,7 +440,8 @@ enum station_info_flags {
 	STATION_INFO_SIGNAL_AVG		= 1<<13,
 	STATION_INFO_RX_BITRATE		= 1<<14,
 	STATION_INFO_BSS_PARAM          = 1<<15,
-	STATION_INFO_CONNECTED_TIME	= 1<<16
+	STATION_INFO_CONNECTED_TIME	= 1<<16,
+	STATION_INFO_ASSOC_REQ_IES	= 1<<17
 };
 
 /**
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index ca76977..253e563 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2236,7 +2236,7 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
 	}
 	nla_nest_end(msg, sinfoattr);
 
-	if (sinfo->assoc_req_ies)
+	if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
 		NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
 			sinfo->assoc_req_ies);
 
-- 
1.7.3.2

Re: [PATCH] cfg80211: fix a crash in nl80211_send_station

[Jouni Malinen]

On Wed, Aug 10, 2011 at 07:00:33PM -0600, Felix Fietkau wrote:
> mac80211 leaves sinfo->assoc_req_ies uninitialized, causing a random
> pointer memory access in nl80211_send_station.
> Instead of checking if the pointer is null, use sinfo->filled, like
> the rest of the fields.

Thanks! This was too easy a trap to fall into.. It looked obvious that
sinfo would be cleared before calls, but clearly not (well, it was
cleared in the driver that I used for testing this ;-). I'll see if an
additional patch could be added to make this less likely to happen
again.

-- 
Jouni Malinen                                            PGP id EFC895FA

Re: [PATCH] cfg80211: fix a crash in nl80211_send_station

[Larry Finger]

On 08/10/2011 08:00 PM, Felix Fietkau wrote:
> mac80211 leaves sinfo->assoc_req_ies uninitialized, causing a random
> pointer memory access in nl80211_send_station.
> Instead of checking if the pointer is null, use sinfo->filled, like
> the rest of the fields.
>
> Signed-off-by: Felix Fietkau<nbd@openwrt.org>

John,

I hope this patch will be added to wireless-testing soon. It is particularly 
insidious as it leads to kernel panics or spontaneous reboots. Note: the problem 
occurs even when the NIC is not being used as an AP.

Thanks,

Larry