linux-stable.git/net/wireless/scan.c, branch linux-2.6.31.y

cfg80211: fix looping soft lockup in find_ie()

2009-09-24T15:43:51+00:00

commit fcc6cb0c13555e78c2d47257b6d1b5e59b0c419a upstream.

The find_ie() function uses a size_t for the len parameter, and
directly uses len as a loop variable.  If any received packets
are malformed, it is possible for the decrease of len to overflow,
and since the result is unsigned, the loop will not terminate.
Change it to a signed int so the loop conditional works for
negative values.

This fixes the following soft lockup:

[38573.102007] BUG: soft lockup - CPU#0 stuck for 61s! [phy0:2230]
[38573.102007] Modules linked in: aes_i586 aes_generic fuse af_packet ipt_REJECT xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_state iptable_filter ip_tables x_tables acpi_cpufreq binfmt_misc dm_mirror dm_region_hash dm_log dm_multipath dm_mod kvm_intel kvm uinput i915 arc4 ecb drm snd_hda_codec_idt ath5k snd_hda_intel hid_apple mac80211 usbhid appletouch snd_hda_codec snd_pcm ath cfg80211 snd_timer i2c_algo_bit ohci1394 video snd processor ieee1394 rfkill ehci_hcd sg sky2 backlight snd_page_alloc uhci_hcd joydev output ac thermal button battery sr_mod applesmc cdrom input_polldev evdev unix [last unloaded: scsi_wait_scan]
[38573.102007] irq event stamp: 2547724535
[38573.102007] hardirqs last  enabled at (2547724534): [] restore_all_notrace+0x0/0x18
[38573.102007] hardirqs last disabled at (2547724535): [] apic_timer_interrupt+0x28/0x34
[38573.102007] softirqs last  enabled at (92950144): [] __do_softirq+0x108/0x210
[38573.102007] softirqs last disabled at (92950274): [] _spin_lock_bh+0x14/0x80
[38573.102007]
[38573.102007] Pid: 2230, comm: phy0 Tainted: G        W  (2.6.31-rc7-wl #8) MacBook1,1
[38573.102007] EIP: 0060:[] EFLAGS: 00010292 CPU: 0
[38573.102007] EIP is at cmp_ies+0x30/0x180 [cfg80211]
[38573.102007] EAX: 00000082 EBX: 00000000 ECX: ffffffc1 EDX: d8efd014
[38573.102007] ESI: ffffff7c EDI: 0000004d EBP: eee2dc50 ESP: eee2dc3c
[38573.102007]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[38573.102007] CR0: 8005003b CR2: d8efd014 CR3: 01694000 CR4: 000026d0
[38573.102007] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[38573.102007] DR6: ffff0ff0 DR7: 00000400
[38573.102007] Call Trace:
[38573.102007]  [] cmp_bss+0xed/0x100 [cfg80211]
[38573.102007]  [] cfg80211_bss_update+0x84/0x410 [cfg80211]
[38573.102007]  [] cfg80211_inform_bss_frame+0x114/0x180 [cfg80211]
[38573.102007]  [] ieee80211_bss_info_update+0x4f/0x180 [mac80211]
[38573.102007]  [] ieee80211_rx_bss_info+0x88/0xf0 [mac80211]
[38573.102007]  [] ? ieee802_11_parse_elems+0x27/0x30 [mac80211]
[38573.102007]  [] ieee80211_rx_mgmt_probe_resp+0xa4/0x1c0 [mac80211]
[38573.102007]  [] ieee80211_sta_rx_queued_mgmt+0x919/0xc50 [mac80211]
[38573.102007]  [] ? sched_clock+0x27/0xa0
[38573.102007]  [] ? sched_clock+0x27/0xa0
[38573.102007]  [] ? mark_held_locks+0x60/0x80
[38573.102007]  [] ? _spin_unlock_irqrestore+0x55/0x70
[38573.102007]  [] ? sub_preempt_count+0x85/0xc0
[38573.102007]  [] ? _spin_unlock_irqrestore+0x3e/0x70
[38573.102007]  [] ? skb_dequeue+0x4f/0x70
[38573.102007]  [] ieee80211_sta_work+0x91/0xb80 [mac80211]
[38573.102007]  [] ? sched_clock+0x27/0xa0
[38573.102007]  [] ? sub_preempt_count+0x85/0xc0
[38573.102007]  [] worker_thread+0x18f/0x320
[38573.102007]  [] ? worker_thread+0x12e/0x320
[38573.102007]  [] ? _spin_unlock_irqrestore+0x55/0x70
[38573.102007]  [] ? ieee80211_sta_work+0x0/0xb80 [mac80211]
[38573.102007]  [] ? autoremove_wake_function+0x0/0x50
[38573.102007]  [] ? worker_thread+0x0/0x320
[38573.102007]  [] kthread+0x84/0x90
[38573.102007]  [] ? kthread+0x0/0x90
[38573.102007]  [] kernel_thread_helper+0x7/0x10

Signed-off-by: Bob Copeland 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

cfg80211: add two missing NULL pointer checks

2009-08-03T20:31:21+00:00

These pointers can be NULL, the is_mesh() case isn't
ever hit in the current kernel, but cmp_ies() can be
hit under certain conditions.

Signed-off-by: Johannes Berg 
Cc: stable@kernel.org [2.6.29, 2.6.30]
Signed-off-by: John W. Linville

cfg80211: double free in __cfg80211_scan_done

2009-07-21T16:07:44+00:00

This patch fixes a double free corruption in __cfg80211_scan_done:

 ================================================
 BUG kmalloc-512: Object already free
 ------------------------------------------------

 INFO: Allocated in load_elf_binary+0x18b/0x19af age=6
 INFO: Freed in load_elf_binary+0x104e/0x19af age=5
 INFO: Slab 0xffffea0001bae4c0 objects=14 used=7
 INFO: Object 0xffff88007e8a9918 @offset=6424 fp=0xffff88007e8a9488

 Bytes b4 0xffff88007e8a9908:  00 00 00 00 00 00 00 00 5a 5a
 [...]
 Pid: 28705, comm: rmmod Tainted: P         C 2.6.31-rc2-wl #1
 Call Trace:
  [] print_trailer+0x14e/0x16e
  [] object_err+0x42/0x61
  [] __slab_free+0x2af/0x396
  [] ? wiphy_unregister+0x92/0x142 [cfg80211]
  [] kfree+0x13c/0x17a
  [] ? wiphy_unregister+0x92/0x142 [cfg80211]
  [] wiphy_unregister+0x92/0x142 [cfg80211]
  [] ieee80211_unregister_hw+0xc8/0xff [mac80211]
  [] p54_unregister_common+0x31/0x66 [p54common]
  [...]
 FIX kmalloc-512: Object at 0xffff88007e8a9918 not freed

The code path which leads to the *funny* double free:

       request = rdev->scan_req;
       dev = dev_get_by_index(&init_net, request->ifidx);
	/*
	 * the driver was unloaded recently and
	 * therefore dev_get_by_index will return NULL!
	 */
        if (!dev)
                goto out;
	[...]
	rdev->scan_req = NULL; /* not executed... */
	[...]
 out:
        kfree(request);

Signed-off-by: Christian Lamparter 
Signed-off-by: John W. Linville

cfg80211: fix refcount leak

2009-07-07T16:55:28+00:00

The code in cfg80211's cfg80211_bss_update erroneously
grabs a reference to the BSS, which means that it will
never be freed.

Signed-off-by: Johannes Berg 
Cc: stable@kernel.org [2.6.29, 2.6.30]
Signed-off-by: John W. Linville

nl80211: bounce scan request back to userspace

2009-06-03T18:05:10+00:00

When a scan finishes only the program that asked for it
knows what kind of scan it was; let's tell everybody else
about the scan parameters as well so they can evaluate
the result of the scan better. Also helps with debugging.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6

2009-05-08T19:46:17+00:00

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2009-05-08T09:48:30+00:00

Conflicts:
	include/net/tcp.h

cfg80211: Use the correct IE buffer pointer

2009-05-06T19:14:44+00:00

If the IE buffer was allocated, the pub.information_elements pointer
was also changed to the allocated space. So we must not assume anymore
that the pointer points at the "found" tail.

So if it was allocated previously, take the codebranch that grows the
buffer size (if necessary) and put the data into the allocated buffer.

Signed-off-by: Michael Buesch 
Acked-by: Johannes Berg 
Signed-off-by: John W. Linville

cfg80211: Remove unnecessary ksize() call

2009-05-06T19:14:42+00:00

This removes an unnecessary ksize() call. krealloc() will do this
test internally and won't perform any allocation if the space is
already sufficient to hold the data.
So remove the redundant check.

Signed-off-by: Michael Buesch 
Reviewed-by: Johannes Berg 
Signed-off-by: John W. Linville

cfg80211: fix truncated IEs

2009-05-04T20:22:10+00:00

Another bug in the "cfg80211: do not replace BSS structs" patch,
a forgotten length update leads to bogus data being stored and
passed to userspace, often truncated.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville