netdev - Re: [PATCH 00/16] wl1251 patches from linux-n900 tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201311252054.41177@pali>
Date:	Mon, 25 Nov 2013 20:54:41 +0100
From:	Pali Rohár <pali.rohar@...il.com>
To:	Felipe Contreras <felipe.contreras@...il.com>
Cc:	Luciano Coelho <luca@...lho.fi>,
	"John W. Linville" <linville@...driver.com>,
	Johannes Berg <johannes@...solutions.net>,
	"David S. Miller" <davem@...emloft.net>,
	"linux-wireless Mailing List" <linux-wireless@...r.kernel.org>,
	netdev@...r.kernel.org,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	freemangordon@....bg, aaro.koskinen@....fi,
	Pavel Machek <pavel@....cz>, sre@...g0.de,
	joni.lapilainen@...il.com
Subject: Re: [PATCH 00/16] wl1251 patches from linux-n900 tree

On Friday 08 November 2013 15:20:07 Felipe Contreras wrote:
> On Sat, Oct 26, 2013 at 3:33 PM, Pali Rohár <pali.rohar@...il.com> wrote:
> > Hello, I'm sending wl1251 patches from linux-n900 tree [1]
> > for comments. More patches come from David's monitor &
> > packet injection work. Patches are tested with 3.12 rc5
> > kernel on Nokia N900.
> > 
> > [1] - https://gitorious.org/linux-n900/linux-n900
> 
> How did you test these patches? I get a panic loop immediately
> after I bring the interface loop in monitor mode (v3.12).

Hi!

now I can reproduce this crash with 3.12-rc5 kernel. Problem
looks like irrelevant to this patch series and is present in 3.12
kernel. There is possible NULL pointer dereference.

With this patch I'm not able to reproduce this bug:

diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
index 192cebd..db01053 100644
--- a/drivers/net/wireless/ti/wl1251/event.c
+++ b/drivers/net/wireless/ti/wl1251/event.c
@@ -124,7 +124,7 @@ static int wl1251_event_process(struct wl1251 *wl, struct event_mailbox *mbox)
 			return ret;
 	}
 
-	if (vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
+	if (wl->vif && vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
 		wl1251_debug(DEBUG_EVENT, "SYNCHRONIZATION_TIMEOUT_EVENT");
 
 		/* indicate to the stack, that beacons have been lost */


-- 
Pali Rohár
pali.rohar@...il.com

Download attachment "signature.asc " of type "application/pgp-signature" (199 bytes)