netdev - Re: zd1211rw (2.6.22 sparc64): unaligned access (do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 20 Nov 2007 14:15:40 +0100
From:	Johannes Berg <johannes@...solutions.net>
To:	David Miller <davem@...emloft.net>
Cc:	shaddy_baddah@...mail.com, linux-wireless@...r.kernel.org,
	netdev@...r.kernel.org, Jean Tourrilhes <jt@....hp.com>
Subject: Re: zd1211rw (2.6.22 sparc64): unaligned access (do_rx)


> I think I've figured out what's happening here.
> 
> The kernel makes no effort whatsoever to translate iwe streams in
> compat environments.  And userspace then tries to "correct" this and
> does so miserably.  Likely this is what causes the bus error.

Quite possible. I wanted this fixed too but Jean refused to do it in the
kernel. And personally, I'm no longer touching wext with a 10 foot pole.
Too much backslash.

> The fix is that we need to add some handling code
> fs/compat_ioctl.c:do_wireless_ioctl() for the case where we are
> returning an iwe stream (SIOCGIWSCAN).
> 
> It should not be very difficult to do this, since the compat format
> will be the same size or smaller, it should be easy to recode the
> thing in-place in the user buffer.
> 
> So you make a pass over the user buffer fixing things up and then you
> adjust the iw_data length for the new size.
> 
> Alternatively, you can allocate a kernel buffer for this, use a 'fs =
> get_fs(); set_fs(KERNEL_DS); ioctl(); set_fs(fs);' sequence, fixup the
> iwe stream, then copy the everything back out to userspace.

That may work, but wext also broadcasts iw_point inside netlink messages
for scan notifications etc. I don't see a good way to fix this part.

> Then we can delete all of this incredibly stupid code in the wireless
> tools that attempts to fix this up in userspace.

I wish. Really, I do.

johannes

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)