linux-stable.git/net/wireless, branch linux-2.6.30.y

cfg80211: fix looping soft lockup in find_ie()

2009-09-24T15:27:10+00:00

commit fcc6cb0c13555e78c2d47257b6d1b5e59b0c419a upstream.

The find_ie() function uses a size_t for the len parameter, and
directly uses len as a loop variable.  If any received packets
are malformed, it is possible for the decrease of len to overflow,
and since the result is unsigned, the loop will not terminate.
Change it to a signed int so the loop conditional works for
negative values.

This fixes the following soft lockup:

[38573.102007] BUG: soft lockup - CPU#0 stuck for 61s! [phy0:2230]
[38573.102007] Modules linked in: aes_i586 aes_generic fuse af_packet ipt_REJECT xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_state iptable_filter ip_tables x_tables acpi_cpufreq binfmt_misc dm_mirror dm_region_hash dm_log dm_multipath dm_mod kvm_intel kvm uinput i915 arc4 ecb drm snd_hda_codec_idt ath5k snd_hda_intel hid_apple mac80211 usbhid appletouch snd_hda_codec snd_pcm ath cfg80211 snd_timer i2c_algo_bit ohci1394 video snd processor ieee1394 rfkill ehci_hcd sg sky2 backlight snd_page_alloc uhci_hcd joydev output ac thermal button battery sr_mod applesmc cdrom input_polldev evdev unix [last unloaded: scsi_wait_scan]
[38573.102007] irq event stamp: 2547724535
[38573.102007] hardirqs last  enabled at (2547724534): [] restore_all_notrace+0x0/0x18
[38573.102007] hardirqs last disabled at (2547724535): [] apic_timer_interrupt+0x28/0x34
[38573.102007] softirqs last  enabled at (92950144): [] __do_softirq+0x108/0x210
[38573.102007] softirqs last disabled at (92950274): [] _spin_lock_bh+0x14/0x80
[38573.102007]
[38573.102007] Pid: 2230, comm: phy0 Tainted: G        W  (2.6.31-rc7-wl #8) MacBook1,1
[38573.102007] EIP: 0060:[] EFLAGS: 00010292 CPU: 0
[38573.102007] EIP is at cmp_ies+0x30/0x180 [cfg80211]
[38573.102007] EAX: 00000082 EBX: 00000000 ECX: ffffffc1 EDX: d8efd014
[38573.102007] ESI: ffffff7c EDI: 0000004d EBP: eee2dc50 ESP: eee2dc3c
[38573.102007]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[38573.102007] CR0: 8005003b CR2: d8efd014 CR3: 01694000 CR4: 000026d0
[38573.102007] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[38573.102007] DR6: ffff0ff0 DR7: 00000400
[38573.102007] Call Trace:
[38573.102007]  [] cmp_bss+0xed/0x100 [cfg80211]
[38573.102007]  [] cfg80211_bss_update+0x84/0x410 [cfg80211]
[38573.102007]  [] cfg80211_inform_bss_frame+0x114/0x180 [cfg80211]
[38573.102007]  [] ieee80211_bss_info_update+0x4f/0x180 [mac80211]
[38573.102007]  [] ieee80211_rx_bss_info+0x88/0xf0 [mac80211]
[38573.102007]  [] ? ieee802_11_parse_elems+0x27/0x30 [mac80211]
[38573.102007]  [] ieee80211_rx_mgmt_probe_resp+0xa4/0x1c0 [mac80211]
[38573.102007]  [] ieee80211_sta_rx_queued_mgmt+0x919/0xc50 [mac80211]
[38573.102007]  [] ? sched_clock+0x27/0xa0
[38573.102007]  [] ? sched_clock+0x27/0xa0
[38573.102007]  [] ? mark_held_locks+0x60/0x80
[38573.102007]  [] ? _spin_unlock_irqrestore+0x55/0x70
[38573.102007]  [] ? sub_preempt_count+0x85/0xc0
[38573.102007]  [] ? _spin_unlock_irqrestore+0x3e/0x70
[38573.102007]  [] ? skb_dequeue+0x4f/0x70
[38573.102007]  [] ieee80211_sta_work+0x91/0xb80 [mac80211]
[38573.102007]  [] ? sched_clock+0x27/0xa0
[38573.102007]  [] ? sub_preempt_count+0x85/0xc0
[38573.102007]  [] worker_thread+0x18f/0x320
[38573.102007]  [] ? worker_thread+0x12e/0x320
[38573.102007]  [] ? _spin_unlock_irqrestore+0x55/0x70
[38573.102007]  [] ? ieee80211_sta_work+0x0/0xb80 [mac80211]
[38573.102007]  [] ? autoremove_wake_function+0x0/0x50
[38573.102007]  [] ? worker_thread+0x0/0x320
[38573.102007]  [] kthread+0x84/0x90
[38573.102007]  [] ? kthread+0x0/0x90
[38573.102007]  [] kernel_thread_helper+0x7/0x10

Signed-off-by: Bob Copeland 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

cfg80211: add two missing NULL pointer checks

2009-08-16T21:18:37+00:00

commit cd3468bad96c00b5a512f551674f36776129520e upstream.

These pointers can be NULL, the is_mesh() case isn't
ever hit in the current kernel, but cmp_ies() can be
hit under certain conditions.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

cfg80211: fix refcount leak

2009-07-30T21:39:09+00:00

commit 2dce4c2b5f0b43bd25bf9ea6ded06b7f8a54c91f upstream.

The code in cfg80211's cfg80211_bss_update erroneously
grabs a reference to the BSS, which means that it will
never be freed.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

cfg80211: fix in nl80211_set_reg()

2009-07-02T23:50:10+00:00

commit 61405e97788b1bc4e7c5be5b4ec04a73fc11bac2 upstream.

There is a race on access to last_request and its alpha2
through reg_is_valid_request() and us possibly processing
first another regulatory request on another CPU. We avoid
this improbably race by locking with the cfg80211_mutex as
we should have done in the first place. While at it add
the assert on locking on reg_is_valid_request().

Signed-off-by: Luis R. Rodriguez 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

cfg80211: return immediately if num reg rules > NL80211_MAX_SUPP_REG_RULES

2009-07-02T23:50:09+00:00

commit 4776c6e7f66f853011bc1fd6fe37fa63f0b6982c upstream.

This has no functional change except we save a kfree(rd) and
allows us to clean this code up a bit after this. We do
avoid an unnecessary kfree(NULL) but calling that was OK too.

Signed-off-by: Luis R. Rodriguez 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

cfg80211: cleanup return calls on nl80211_set_reg()

2009-07-02T23:50:08+00:00

commit d0e18f833d23afefb6751a21d14a2cd71d2d4d66 upstream.

This has no functional change, but it will make the race
fix easier to spot in my next patch.

Signed-off-by: Luis R. Rodriguez 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

cfg80211: fix for duplicate userspace replies

2009-07-02T23:50:07+00:00

commit 729e9c7663190d71fe5e29831634df80f38199c1 upstream.

This fixes an incorrect assumption (BUG_ON) made in
cfg80211 when handling country IE regulatory requests.
The assumption was that we won't try to call_crda()
twice for the same event and therefore we will not
recieve two replies through nl80211 for the regulatory
request. As it turns out it is true we don't call_crda()
twice for the same event, however, kobject_uevent_env()
*might* send the udev event twice and/or userspace can
simply process the udev event twice. We remove the BUG_ON()
and simply ignore the duplicate request.

For details refer to this thread:

http://marc.info/?l=linux-wireless&m=124149987921337&w=2

Reported-by: Maxim Levitsky 
Signed-off-by: Luis R. Rodriguez 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

cfg80211: fix race between core hint and driver's custom apply

2009-05-20T18:29:54+00:00

Its possible for cfg80211 to have scheduled the work and for
the global workqueue to not have kicked in prior to a cfg80211
driver's regulatory hint or wiphy_apply_custom_regulatory().

Although this is very unlikely its possible and should fix
this race. When this race would happen you are expected to have
hit a null pointer dereference panic.

Cc: stable@kernel.org
Signed-off-by: Luis R. Rodriguez 
Tested-by: Alan Jenkins 
Signed-off-by: John W. Linville

wext: verify buffer size for SIOCSIWENCODEEXT

2009-05-20T18:07:50+00:00

Another design flaw in wireless extensions (is anybody
surprised?) in the way it handles the iw_encode_ext
structure: The structure is part of the 'extra' memory
but contains the key length explicitly, instead of it
just being the length of the extra buffer - size of
the struct and using the explicit key length only for
the get operation (which only writes it).

Therefore, we have this layout:

extra: +-------------------------+
       | struct iw_encode_ext  { |
       |     ...                 |
       |     u16 key_len;        |
       |     u8 key[0];          |
       | };                      |
       +-------------------------+
       | key material            |
       +-------------------------+

Now, all drivers I checked use ext->key_len without
checking that both key_len and the struct fit into the
extra buffer that has been copied from userspace. This
leads to a buffer overrun while reading that buffer,
depending on the driver it may be possible to specify
arbitrary key_len or it may need to be a proper length
for the key algorithm specified.

Thankfully, this is only exploitable by root, but root
can actually cause a segfault or use kernel memory as
a key (which you can even get back with siocgiwencode
or siocgiwencodeext from the key buffer).

Fix this by verifying that key_len fits into the buffer
along with struct iw_encode_ext.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

cfg80211: fix comment on regulatory hint processing

2009-05-04T20:22:14+00:00

Signed-off-by: Luis R. Rodriguez 
Signed-off-by: John W. Linville