linux-kernel - Re: BUG: unable to handle kernel NULL pointer dereference in cfg80211_wext

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200113092820.GB9510@kadam>
Date:   Mon, 13 Jan 2020 12:28:20 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Justin Capella <justincapella@...il.com>
Cc:     Johannes Berg <johannes@...solutions.net>,
        syzbot <syzbot+34b582cf32c1db008f8e@...kaller.appspotmail.com>,
        "David S. Miller" <davem@...emloft.net>,
        LKML <linux-kernel@...r.kernel.org>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        syzkaller-bugs@...glegroups.com,
        Cody Schuffelen <schuffelen@...gle.com>
Subject: Re: BUG: unable to handle kernel NULL pointer dereference in
 cfg80211_wext_siwrts

That's the wrong ops struct?  I think I was looking at the "previous
report" that Johannes mentioned where it was crashing because
virt_wifi doesn't implement a set_wiphy_params function.

Smatch says there are two other drivers, the libertas and ipw2x00 which
don't have a set_wiphy_params function either.  But maybe those handle
it a different way.

drivers/net/wireless/marvell/libertas/cfg.c | (null)                         | (struct cfg80211_ops)->set_wiphy_params | 0
drivers/net/wireless/virt_wifi.c | (null)                         | (struct cfg80211_ops)->set_wiphy_params | 0
drivers/net/wireless/intel/ipw2x00/libipw_module.c | (null)                         | (struct cfg80211_ops)->set_wiphy_params | 0

regards,
dan carpenter

On Fri, Jan 10, 2020 at 09:23:57PM -0800, Justin Capella wrote:
> I noticed pfifo_qdisc_ops is exported as default_qdisc_ops is it
> possible this is how rdev->ops is NULL
> 
> Seems unlikely, but thought I'd point it out.
> 
> 
> On Fri, Jan 10, 2020 at 11:13 AM Johannes Berg
> <johannes@...solutions.net> wrote:
> >
> > On Fri, 2020-01-10 at 11:11 -0800, syzbot wrote:
> > > Hello,
> > >
> > > syzbot found the following crash on:
> > >
> > > HEAD commit:    2f806c2a Merge branch 'net-ungraft-prio'
> > > git tree:       net
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=1032069ee00000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=5c90cac8f1f8c619
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=34b582cf32c1db008f8e
> > > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > >
> > > Unfortunately, I don't have any reproducer for this crash yet.
> >
> > It's quite likely also in virt_wifi, evidently that has some issues.
> >
> > Cody, did you take a look at the previous report by any chance?
> >
> > johannes
> >
> 
> -- 
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@...glegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/CAMrEMU_a9evtp26tYB6VUxznmSmH98AmpP8xnejQr5bGTgE%2B8g%40mail.gmail.com.