linux-kernel - Re: Wireless-testing's b43 panics in b43_generate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 31 May 2008 12:48:42 -0400
From:	Pavel Roskin <proski@....org>
To:	Stefanik Gábor <netrolller.3d@...il.com>
Cc:	"bcm43xx-dev@...ts.berlios.de" <bcm43xx-dev@...ts.berlios.de>,
	linux-wireless <linux-wireless@...r.kernel.org>,
	linux-kernel@...r.kernel.org
Subject: Re: Wireless-testing's b43 panics in b43_generate_txhdr on packet
	transmit

Hello!

You beat me at reporting it.  I was about to report the same thing.
Basically, my laptop with bcm4311 started crashing when using WEP in the
last weeks.  Its runs the current wireless-testing.

On Sat, 2008-05-31 at 16:23 +0200, Stefanik Gábor wrote:
>  #4 [c04619c8] b43_generate_txhdr at f8dd3a99

Yes, that's where it happens.  This patch prevents the panic, but it's
almost certainly not the right fix.

diff --git a/drivers/net/wireless/b43/xmit.c
b/drivers/net/wireless/b43/xmit.c
index f9e1cff..5ec8d86 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -234,11 +234,14 @@ int b43_generate_txhdr(struct b43_wldev *dev,

 	plcp_fragment_len = fragment_len + FCS_LEN;
 	if (use_encryption) {
-		u8 key_idx = info->control.hw_key->hw_key_idx;
+		u8 key_idx;
 		struct b43_key *key;
 		int wlhdr_len;
 		size_t iv_len;

+		if (!info->control.hw_key)
+			return -ENOKEY;
+		key_idx = info->control.hw_key->hw_key_idx;
 		B43_WARN_ON(key_idx >= dev->max_nr_keys);
 		key = &(dev->key[key_idx]);

Another workaround is to use nohwcrypt=1 in the module options.

It's strange that other drivers (b43legacy, ath5k) use
info->control.hw_key->hw_key_idx under the same conditions (see how
use_encryption is calculated), but don't have any problems on the same
network (but I need to recheck).

I'm using 40-bit WEP with wpa_supplicant (because it's configured to
recognize many networks, some of which are with WPA).  I don't know if
it's relevant.  It's Fedora 9 for x86_64, but NetworkManager is
disabled.

-- 
Regards,
Pavel Roskin
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/