netdev - Re: [PATCH 1/1] rtlwifi: Convert drivers to use new API for ieee80211_is_robust_mgmt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 21 Feb 2014 15:38:50 +0100
From:	Johannes Berg <johannes@...solutions.net>
To:	Larry Finger <Larry.Finger@...inger.net>
Cc:	linville@...driver.com, linux-wireless@...r.kernel.org,
	netdev@...r.kernel.org
Subject: Re: [PATCH 1/1] rtlwifi: Convert drivers to use new API for
 ieee80211_is_robust_mgmt_frame()

On Fri, 2014-02-21 at 08:33 -0600, Larry Finger wrote:
> Drivers rtl8188ee, rtl8192ce, rtl8192se, and rtl8723ae all use this routine.
> In addition, all callers of ieee80211_is_robust_mgmt_frame() have access to the
> skb. Thus, it is trivial to use the new API rather than the underscored old version.

Unfortunately, I'm pretty sure this is incorrect. I looked at this code
before, and take for example:

> +++ b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
> @@ -334,8 +334,8 @@ bool rtl8723ae_rx_query_desc(struct ieee80211_hw *hw,
>  			/* during testing, hdr could be NULL here */
>  			return false;
>  		}
> -		if ((_ieee80211_is_robust_mgmt_frame(hdr)) &&
> -			(ieee80211_has_protected(hdr->frame_control)))
> +		if ((ieee80211_is_robust_mgmt_frame(skb)) &&
> +		    (ieee80211_has_protected(hdr->frame_control)))

Here, hdr is set like this:

                hdr = (struct ieee80211_hdr *)(skb->data +
                       status->rx_drvinfo_size + status->rx_bufshift);  

so the skb clearly contains something else before the hdr, and the
conversion is probably not right because it assumes hdr == skb->data,
where here it isn't that but instead (skb->data + something).

johannes

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html