https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=269323
Bug ID: 269323
Summary: potential NULL dereference in
ieee80211_send_probereq()
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: wireless
Assignee: [email protected]
Reporter: [email protected]
Attachment #239907 text/plain
mime type:
Created attachment 239907
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=239907&action=edit
inject an 80211 packet that provokes a NULL deref in ieee80211_send_probereq()
In response to an arriving packet, adhoc_input() in ieee80211_adhoc.c
can set ni to NULL and then pass it to ieee80211_send_probereq(),
which tries to dereference it.
if (ieee80211_ibss_node_check_new(ni, &scan)) {
...;
} else
ni = NULL;
if (! (ic->ic_flags & IEEE80211_F_SCAN)){
ieee80211_send_probereq(ni, /* node */
vap->iv_myaddr, /* SA */
ni->ni_macaddr, /* DA */
vap->iv_bss->ni_bssid, /* BSSID
\
*/
vap->iv_bss->ni_essid,
vap->iv_bss->ni_esslen); /*
SSID\
*/
}
I've attached a demo, which needs to be run twice:
# cc wtap2a.c
# ./a.out
# ./a.out
...
panic: Fatal page fault at 0xffffffc00043afea: 0000000000000000
panic() at panic+0x2a
page_fault_handler() at page_fault_handler+0x1d6
do_trap_supervisor() at do_trap_supervisor+0x74
cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x70
--- exception 13, tval = 0
ieee80211_send_probereq() at ieee80211_send_probereq+0x20
adhoc_recv_mgmt() at adhoc_recv_mgmt+0x5b8
wtap_recv_mgmt() at wtap_recv_mgmt+0x28
adhoc_input() at adhoc_input+0x990
ieee80211_input_mimo() at ieee80211_input_mimo+0x6e
ieee80211_input_mimo_all() at ieee80211_input_mimo_all+0x52
ieee80211_input_all() at ieee80211_input_all+0x44
.LBB2_14() at .LBB2_14+0x1e
taskqueue_run_locked() at taskqueue_run_locked+0x96
taskqueue_thread_loop() at taskqueue_thread_loop+0x62
fork_exit() at fork_exit+0x80
fork_trampoline() at fork_trampoline+0xa
--
You are receiving this mail because:
You are the assignee for the bug.
