linux-kernel - Re: [RFC: 2.6 patch] hostap_80211

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 6 Nov 2006 21:46:51 +0300
From:	Alexey Dobriyan <adobriyan@...il.com>
To:	Adrian Bunk <bunk@...sta.de>
Cc:	linville@...driver.com, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [RFC: 2.6 patch] hostap_80211_rx(): fix a use-after-free

On Mon, Nov 06, 2006 at 03:21:48PM +0100, Adrian Bunk wrote:
> This patch fixes a use-after-free for "skb" spotted by the Coverity
> checker.

> --- linux-2.6/drivers/net/wireless/hostap/hostap_80211_rx.c.old
> +++ linux-2.6/drivers/net/wireless/hostap/hostap_80211_rx.c
> @@ -1004,10 +1004,10 @@ void hostap_80211_rx(struct net_device *
>  			if (local->hostapd && local->apdev) {
>  				/* Send IEEE 802.1X frames to the user
>  				 * space daemon for processing */
> -				prism2_rx_80211(local->apdev, skb, rx_stats,
> -						PRISM2_RX_MGMT);
>  				local->apdevstats.rx_packets++;
>  				local->apdevstats.rx_bytes += skb->len;
> +				prism2_rx_80211(local->apdev, skb, rx_stats,
> +						PRISM2_RX_MGMT);
>  				goto rx_exit;

Network drivers set rx_packets and rx_bytes after netif_rx. And last_rx,
too. The trick seems to be to use pkt_len variable.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/