From: Johannes Berg <johannes@sipsolutions•net>
To: Linus Torvalds <torvalds@linux-foundation•org>
Cc: David Miller <davem@davemloft•net>,
John Linville <linville@tuxdriver•com>,
Linux Wireless List <linux-wireless@vger•kernel.org>,
Network Development <netdev@vger•kernel.org>
Subject: Re: nl80211 NULL pointer dereference
Date: Wed, 19 Jun 2013 09:54:48 +0200 [thread overview]
Message-ID: <1371628488.8349.3.camel@jlt4.sipsolutions.net> (raw)
In-Reply-To: <CA+55aFz=eG5-zh1toHxrx=4Qm4DvwyiBCU3u-6tc0-utfZ6xiA@mail.gmail.com> (sfid-20130619_042459_700600_08CD35A3)
On Tue, 2013-06-18 at 16:24 -1000, Linus Torvalds wrote:
> So it would seem that it's that
>
> info->attrs[NL80211_ATTR_REG_RULES]
>
> thing that is NULL.
>
> And yes, the code checks that for being non-NULL in at the top of the
> function, but maybe there is a race with something else setting it to
> NULL? There is a kzalloc(GFP_KERNEL) in between, so it doesn't even
> have to be a very small race...
Yes. I looked at it, and reproduced it (after making the window larger
by putting some sleeps in there and WARN_ON()). It's really just a
stupid mistake I made: in nl80211_dump_wiphy() I parse attributes into
the global nl80211_fam.attrbuf, without making sure that it has proper
locking. Normally we do something like that only on the first iteration
of a dump which is OK because it's locked, but here I did it always,
which is clearly a bug.
I'll have a patch in a minute.
johannes
next prev parent reply other threads:[~2013-06-19 7:54 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-06-19 1:46 nl80211 NULL pointer dereference Linus Torvalds
[not found] ` <CA+55aFxOde8n0M2=77-TQ2Ea9iz8s-e8zGFwjj6RVyMFXBgxEA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2013-06-19 2:06 ` David Miller
[not found] ` <20130618.190632.33329016434510583.davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
2013-06-19 2:24 ` Linus Torvalds
2013-06-19 7:47 ` David Miller
2013-06-19 7:54 ` Johannes Berg [this message]
2013-06-19 8:23 ` [PATCH] nl80211: fix attrbuf access race by allocating a separate one Johannes Berg
2013-06-19 8:39 ` David Miller
[not found] ` <20130619.013900.786603036908799505.davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
2013-06-19 13:51 ` John W. Linville
2013-06-19 13:44 ` Sergei Shtylyov
2013-06-19 16:26 ` Linus Torvalds
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1371628488.8349.3.camel@jlt4.sipsolutions.net \
--to=johannes@sipsolutions$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=linux-wireless@vger$(echo .)kernel.org \
--cc=linville@tuxdriver$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=torvalds@linux-foundation$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox