linux-kernel - Re: [PATCH 1/2] mac80211: minstrel, fix memory corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090515182131.GA6439@fancy-poultry.org>
Date:	Fri, 15 May 2009 20:21:31 +0200
From:	Heinz Diehl <htd@...cy-poultry.org>
To:	Jiri Slaby <jirislaby@...il.com>
Cc:	johannes@...solutions.net, linux-wireless@...r.kernel.org,
	linux-kernel@...r.kernel.org, Felix Fietkau <nbd@...nwrt.org>
Subject: Re: [PATCH 1/2] mac80211: minstrel, fix memory corruption

On 04.05.2009, Jiri Slaby wrote: 

> minstrel doesn't count max rate count in fact, since it doesn't use
> a loop variable `i' and hence allocs space only for bitrates found in
> the first band.
[....]

This patchset crashes my WLAN. Reverting it does fix this:

[....]
wlan0: associated
BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
IP: [<ffffffffa0273b0f>] minstrel_alloc_sta+0x6f/0xf0 [mac80211]
PGD 229da2067 PUD 229d07067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP 
last sysfs file:/sys/devices/pci0000:00/0000:00:02.1/usb1/1-7/1-7:1.0/firmware/1-7:1.0/loading CPU 3 

Modules linked in: af_packet
cpufreq_conservative cpufreq_ondemand cpufreq_userspace cpufreq_powersave
powernow_k8 freq_table xt_NOTRACK ipt_REJECT xt_state iptable_raw
iptable_filter nf_conntrack_netbios_ns nf_conntrack_ipv4 nf_conntrack
nf_defrag_ipv4 ip_tables ip6_tables uhci_hcd snd_hda_codec_realtek rt73usb
rt2x00usb rt2x00lib snd_hda_intel ohci1394 snd_hda_codec led_class
ieee1394 input_polldev snd_pcm mac80211 snd_timer rtc_cmos snd ppdev
button forcedeth pcspkr firewire_ohci soundcore i2c_nforce2 rtc_core
rtc_lib parport_pc cfg80211 parport sr_mod snd_page_alloc i2c_core cdrom
sg usbhid ohci_hcd ehci_hcd sd_mod usbcore hmac loop ecb arc4 fuse
edd ext3 jbd fan pata_amd sata_nv libata scsi_mod thermal processor

Pid: 2362, comm: phy0 Not tainted 2.6.30-rc5-git5 #1  
 RIP: 0010:[<ffffffffa0273b0f>][<ffffffffa0273b0f>] minstrel_alloc_sta+0x6f/0xf0 [mac80211]
 RSP: 0018:ffff88022ddc7b90  EFLAGS: 00010206
 RAX: 000000000000000c RBX: ffff88022c150260 RCX: ffff88022c1500c0
 RDX: 0000000000000000 RSI: 0000000000008020 RDI: ffff88022b528740
 RBP: ffff88022b5286c0 R08: 0000000000000000 R09: 0000000000000058
 R10: 000000000000000c R11: ffff88022ddc7cd0 R12: 0000000000008020
 R13: 0000000000000020 R14: 0000000000000020 R15: 0000000000000000
 FS:  00007f6fc24ec6f0(0000) GS:ffff88002807f000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
 CR2: 0000000000000018 CR3: 0000000229dff000 CR4: 00000000000006e0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
 Process phy0 (pid: 2362, threadinfo ffff88022ddc6000, task ffff88022c512cd0)
 Stack: May 15 19:48:40 liesel kernel:0000000000000000 ffff88022c555000 ffff88022c150260 ffff88022f126880
  ffff88022f126600 ffffffffa025c62b ffff88022f126600 ffff88022c150260
  0000000000000053 ffff880229e18044 ffff88022f126880 ffffffffa0264670
 Call Trace:
  [<ffffffffa025c62b>] ? sta_info_alloc+0x8b/0x140 [mac80211]
  [<ffffffffa0264670>] ? ieee80211_rx_mgmt_assoc_resp+0xa20/0xb90 [mac80211]
  [<ffffffffa026f1d1>] ? __ieee80211_tx+0x61/0xd0 [mac80211]
  [<ffffffffa026f34d>] ? ieee80211_tx+0x10d/0x270 [mac80211]
  [<ffffffff8055d25a>] ? thread_return+0x3e/0x6a4
  [<ffffffffa02651f2>] ? ieee80211_sta_work+0xe2/0xab0 [mac80211]
  [<ffffffff80254246>] ? queue_work+0x26/0x60
  [<ffffffffa0265110>] ? ieee80211_sta_work+0x0/0xab0 [mac80211]
  [<ffffffff80253631>] ? worker_thread+0x141/0x230
  [<ffffffff80257c00>] ? autoremove_wake_function+0x0/0x30
  [<ffffffff802534f0>] ? worker_thread+0x0/0x230
  [<ffffffff802534f0>] ? worker_thread+0x0/0x230
  [<ffffffff802577e4>] ? kthread+0x54/0x90
  [<ffffffff8020ce2a>] ? child_rip+0xa/0x20
  [<ffffffff80257790>] ? kthread+0x0/0x90
  [<ffffffff8020ce20>] ? child_rip+0x0/0x20
 Code: 89 c5 31 c0 48 85 ed 74 6c 48 8b 4b
28 31 c0 41 b9 58 00 00 00 44 89 e6 48 8b 51 20 44 8b 52 18 45 85 d2 0f 49
42 18 48 8b 51 28 <39> 42 18 89 c3 0f 4d 5a 18 48 63 fb 49 0f af f9 e8 dc
4e 04 e0 
 RIP  [<ffffffffa0273b0f>] minstrel_alloc_sta+0x6f/0xf0 [mac80211]
 RSP <ffff88022ddc7b90>
 CR2: 0000000000000018
 ---[ end trace 7489e902c4428832 ]---
ifup-dhcp: . 
syslog-ng[3073]: last message repeated 11 times
ifup-dhcp: no IP address yet... backgrounding. 
[....]

Regards,
Heinz.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/