Page MenuHomeFreeBSD
Differential D4818

net80211: fix ieee80211_init_channels() usage
ClosedPublic
Actions

Authored by avos on Jan 7 2016, 3:25 PM.
Tags
None
Referenced Files
F112910864: D4818.diff
Mon, Mar 24, 6:26 AM
Unknown Object (File)
Sun, Mar 23, 10:39 AM
Unknown Object (File)
Sun, Mar 16, 3:24 AM
Unknown Object (File)
Feb 20 2025, 2:06 AM
Unknown Object (File)
Feb 3 2025, 8:55 AM
Unknown Object (File)
Feb 3 2025, 7:48 AM
Unknown Object (File)
Jan 18 2025, 10:35 AM
Unknown Object (File)
Dec 11 2024, 9:55 PM
View All Files
Subscribers
imp

Details

Reviewers
adrian
Commits
rS293339: net80211 drivers: fix ieee80211_init_channels() usage
Summary

Fix out-of-bounds read (all) / write (11n capable) for drivers that are using ieee80211_init_channels() to initialize channel list.

MFC after: 2 weeks.

Test Plan

Tested with

  • RTL8188EU, STA mode.
  • RTL8188CUS, STA mode.
  • WUSB54GC, HOSTAP mode.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

avos updated this revision to Diff 12002.Jan 7 2016, 3:25 PM
avos retitled this revision from to net80211: fix ieee80211_init_channels() usage.
avos updated this object.
avos edited the test plan for this revision. (Show Details)
avos added a reviewer: adrian.
avos set the repository for this revision to rS FreeBSD src repository - subversion.
Herald added a subscriber: imp. · View Herald TranscriptJan 7 2016, 3:25 PM
avos updated this revision to Diff 12003.Jan 7 2016, 3:39 PM

Add rtwn(4)

adrian edited edge metadata.Jan 7 2016, 4:37 PM

Overall this is a good catch. I'm happy to see this merged in this in once the ndis comment is address.

I kinda wonder if we should just create a 'bands' typedef for net80211 to hide this problem in the future.

sys/dev/if_ndis/if_ndis.c
764

This won't work if bits[1] is non-zero, etc. Modify the iterator above to set some flag to 1 if a mode was set, and check if the flag is 0 here.

avos updated this revision to Diff 12009.Jan 7 2016, 5:06 PM
avos edited edge metadata.

Use more proper check for ndis(4).

avos marked an inline comment as done.Jan 7 2016, 5:06 PM
adrian accepted this revision.Jan 7 2016, 6:15 PM
adrian edited edge metadata.

all good, let's do it! thanks!

This revision is now accepted and ready to land.Jan 7 2016, 6:15 PM
Closed by commit rS293339: net80211 drivers: fix ieee80211_init_channels() usage (authored by avos). · Explain WhyJan 7 2016, 6:41 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathSize
sys/
dev/
bwi/
12 lines
if_ndis/
13 lines
iwi/
14 lines
malo/
10 lines
otus/
14 lines
ral/
12 lines
12 lines
12 lines
rtwn/
10 lines
usb/
wlan/
13 lines
13 lines
13 lines
13 lines
11 lines
13 lines
11 lines
10 lines
11 lines

Diff 12009

View Options

sys/dev/bwi/if_bwi.c

Show All 25 Lines
* SUCH DAMAGE. * SUCH DAMAGE.
* *
* $FreeBSD$ * $FreeBSD$
*/ */
#ifndef _VMMAPI_H_ #ifndef _VMMAPI_H_
#define _VMMAPI_H_ #define _VMMAPI_H_
#include <sys/cdefs.h>
#include <sys/param.h> #include <sys/param.h>
#include <sys/cpuset.h> #include <sys/cpuset.h>
#include <machine/vmm.h> #include <machine/vmm.h>
markjUnsubmitted
Done
Inline Actions

Conventionally, cdefs.h is included first (see style(9)). So:

#include <sys/cdefs.h>
#include <sys/param.h>
#include ...
markj: Conventionally, cdefs.h is included first (see style(9)). So: ``` #include <sys/cdefs.h>…
#include <machine/vmm_dev.h> #include <machine/vmm_dev.h>
#include <stdbool.h> #include <stdbool.h>
/* /*
* API version for out-of-tree consumers like grub-bhyve for making compile * API version for out-of-tree consumers like grub-bhyve for making compile
* time decisions. * time decisions.
*/ */
Show All 27 Lines
*/ */
enum { enum {
VM_SYSMEM, VM_SYSMEM,
VM_BOOTROM, VM_BOOTROM,
VM_FRAMEBUFFER, VM_FRAMEBUFFER,
VM_PCIROM, VM_PCIROM,
}; };
__BEGIN_DECLS
/* /*
* Get the length and name of the memory segment identified by 'segid'. * Get the length and name of the memory segment identified by 'segid'.
* Note that system memory segments are identified with a nul name. * Note that system memory segments are identified with a nul name.
* *
* Returns 0 on success and non-zero otherwise. * Returns 0 on success and non-zero otherwise.
*/ */
int vm_get_memseg(struct vmctx *ctx, int ident, size_t *lenp, char *name, int vm_get_memseg(struct vmctx *ctx, int ident, size_t *lenp, char *name,
size_t namesiz); size_t namesiz);
▲ Show 20 Lines • Show All 171 Lines • ▼ Show 20 Linesint vm_setup_freebsd_registers_i386(struct vmctx *vmctx, int vcpu,
uint32_t esp); uint32_t esp);
void vm_setup_freebsd_gdt(uint64_t *gdtr); void vm_setup_freebsd_gdt(uint64_t *gdtr);
/* /*
* Save and restore * Save and restore
*/ */
int vm_snapshot_req(struct vm_snapshot_meta *meta); int vm_snapshot_req(struct vm_snapshot_meta *meta);
int vm_restore_time(struct vmctx *ctx); int vm_restore_time(struct vmctx *ctx);
__END_DECLS
#endif /* _VMMAPI_H_ */ #endif /* _VMMAPI_H_ */
View Options

sys/dev/if_ndis/if_ndis.c

Show All 25 Lines
* SUCH DAMAGE. * SUCH DAMAGE.
* *
* $FreeBSD$ * $FreeBSD$
*/ */
#ifndef _VMMAPI_H_ #ifndef _VMMAPI_H_
#define _VMMAPI_H_ #define _VMMAPI_H_
#include <sys/cdefs.h>
#include <sys/param.h> #include <sys/param.h>
#include <sys/cpuset.h> #include <sys/cpuset.h>
#include <machine/vmm.h> #include <machine/vmm.h>
markjUnsubmitted
Done
Inline Actions

Conventionally, cdefs.h is included first (see style(9)). So:

#include <sys/cdefs.h>
#include <sys/param.h>
#include ...
markj: Conventionally, cdefs.h is included first (see style(9)). So: ``` #include <sys/cdefs.h>…
#include <machine/vmm_dev.h> #include <machine/vmm_dev.h>
#include <stdbool.h> #include <stdbool.h>
/* /*
* API version for out-of-tree consumers like grub-bhyve for making compile * API version for out-of-tree consumers like grub-bhyve for making compile
* time decisions. * time decisions.
*/ */
Show All 27 Lines
*/ */
enum { enum {
VM_SYSMEM, VM_SYSMEM,
VM_BOOTROM, VM_BOOTROM,
VM_FRAMEBUFFER, VM_FRAMEBUFFER,
VM_PCIROM, VM_PCIROM,
}; };
__BEGIN_DECLS
/* /*
* Get the length and name of the memory segment identified by 'segid'. * Get the length and name of the memory segment identified by 'segid'.
* Note that system memory segments are identified with a nul name. * Note that system memory segments are identified with a nul name.
* *
* Returns 0 on success and non-zero otherwise. * Returns 0 on success and non-zero otherwise.
*/ */
int vm_get_memseg(struct vmctx *ctx, int ident, size_t *lenp, char *name, int vm_get_memseg(struct vmctx *ctx, int ident, size_t *lenp, char *name,
size_t namesiz); size_t namesiz);
▲ Show 20 Lines • Show All 171 Lines • ▼ Show 20 Linesint vm_setup_freebsd_registers_i386(struct vmctx *vmctx, int vcpu,
uint32_t esp); uint32_t esp);
void vm_setup_freebsd_gdt(uint64_t *gdtr); void vm_setup_freebsd_gdt(uint64_t *gdtr);
/* /*
* Save and restore * Save and restore
*/ */
int vm_snapshot_req(struct vm_snapshot_meta *meta); int vm_snapshot_req(struct vm_snapshot_meta *meta);
int vm_restore_time(struct vmctx *ctx); int vm_restore_time(struct vmctx *ctx);
__END_DECLS
#endif /* _VMMAPI_H_ */ #endif /* _VMMAPI_H_ */
View Options

sys/dev/iwi/if_iwi.c

Show All 25 Lines
* SUCH DAMAGE. * SUCH DAMAGE.
* *
* $FreeBSD$ * $FreeBSD$
*/ */
#ifndef _VMMAPI_H_ #ifndef _VMMAPI_H_
#define _VMMAPI_H_ #define _VMMAPI_H_
#include <sys/cdefs.h>
#include <sys/param.h> #include <sys/param.h>
#include <sys/cpuset.h> #include <sys/cpuset.h>
#include <machine/vmm.h> #include <machine/vmm.h>
markjUnsubmitted
Done
Inline Actions

Conventionally, cdefs.h is included first (see style(9)). So:

#include <sys/cdefs.h>
#include <sys/param.h>
#include ...
markj: Conventionally, cdefs.h is included first (see style(9)). So: ``` #include <sys/cdefs.h>…
#include <machine/vmm_dev.h> #include <machine/vmm_dev.h>
#include <stdbool.h> #include <stdbool.h>
/* /*
* API version for out-of-tree consumers like grub-bhyve for making compile * API version for out-of-tree consumers like grub-bhyve for making compile
* time decisions. * time decisions.
*/ */
Show All 27 Lines
*/ */
enum { enum {
VM_SYSMEM, VM_SYSMEM,
VM_BOOTROM, VM_BOOTROM,
VM_FRAMEBUFFER, VM_FRAMEBUFFER,
VM_PCIROM, VM_PCIROM,
}; };
__BEGIN_DECLS
/* /*
* Get the length and name of the memory segment identified by 'segid'. * Get the length and name of the memory segment identified by 'segid'.
* Note that system memory segments are identified with a nul name. * Note that system memory segments are identified with a nul name.
* *
* Returns 0 on success and non-zero otherwise. * Returns 0 on success and non-zero otherwise.
*/ */
int vm_get_memseg(struct vmctx *ctx, int ident, size_t *lenp, char *name, int vm_get_memseg(struct vmctx *ctx, int ident, size_t *lenp, char *name,
size_t namesiz); size_t namesiz);
▲ Show 20 Lines • Show All 171 Lines • ▼ Show 20 Linesint vm_setup_freebsd_registers_i386(struct vmctx *vmctx, int vcpu,
uint32_t esp); uint32_t esp);
void vm_setup_freebsd_gdt(uint64_t *gdtr); void vm_setup_freebsd_gdt(uint64_t *gdtr);
/* /*
* Save and restore * Save and restore
*/ */
int vm_snapshot_req(struct vm_snapshot_meta *meta); int vm_snapshot_req(struct vm_snapshot_meta *meta);
int vm_restore_time(struct vmctx *ctx); int vm_restore_time(struct vmctx *ctx);
__END_DECLS
#endif /* _VMMAPI_H_ */ #endif /* _VMMAPI_H_ */
View Options

sys/dev/malo/if_malo.c

Show All 25 Lines
* SUCH DAMAGE. * SUCH DAMAGE.
* *
* $FreeBSD$ * $FreeBSD$
*/ */
#ifndef _VMMAPI_H_ #ifndef _VMMAPI_H_
#define _VMMAPI_H_ #define _VMMAPI_H_
#include <sys/cdefs.h>
#include <sys/param.h> #include <sys/param.h>
#include <sys/cpuset.h> #include <sys/cpuset.h>
#include <machine/vmm.h> #include <machine/vmm.h>
markjUnsubmitted
Done
Inline Actions

Conventionally, cdefs.h is included first (see style(9)). So:

#include <sys/cdefs.h>
#include <sys/param.h>
#include ...
markj: Conventionally, cdefs.h is included first (see style(9)). So: ``` #include <sys/cdefs.h>…
#include <machine/vmm_dev.h> #include <machine/vmm_dev.h>
#include <stdbool.h> #include <stdbool.h>
/* /*
* API version for out-of-tree consumers like grub-bhyve for making compile * API version for out-of-tree consumers like grub-bhyve for making compile
* time decisions. * time decisions.
*/ */
Show All 27 Lines
*/ */
enum { enum {
VM_SYSMEM, VM_SYSMEM,
VM_BOOTROM, VM_BOOTROM,
VM_FRAMEBUFFER, VM_FRAMEBUFFER,
VM_PCIROM, VM_PCIROM,
}; };
__BEGIN_DECLS
/* /*
* Get the length and name of the memory segment identified by 'segid'. * Get the length and name of the memory segment identified by 'segid'.
* Note that system memory segments are identified with a nul name. * Note that system memory segments are identified with a nul name.
* *
* Returns 0 on success and non-zero otherwise. * Returns 0 on success and non-zero otherwise.
*/ */
int vm_get_memseg(struct vmctx *ctx, int ident, size_t *lenp, char *name, int vm_get_memseg(struct vmctx *ctx, int ident, size_t *lenp, char *name,
size_t namesiz); size_t namesiz);
▲ Show 20 Lines • Show All 171 Lines • ▼ Show 20 Linesint vm_setup_freebsd_registers_i386(struct vmctx *vmctx, int vcpu,
uint32_t esp); uint32_t esp);
void vm_setup_freebsd_gdt(uint64_t *gdtr); void vm_setup_freebsd_gdt(uint64_t *gdtr);
/* /*
* Save and restore * Save and restore
*/ */
int vm_snapshot_req(struct vm_snapshot_meta *meta); int vm_snapshot_req(struct vm_snapshot_meta *meta);
int vm_restore_time(struct vmctx *ctx); int vm_restore_time(struct vmctx *ctx);
__END_DECLS
#endif /* _VMMAPI_H_ */ #endif /* _VMMAPI_H_ */
View Options

sys/dev/otus/if_otus.c

Loading...
View Options

sys/dev/ral/rt2560.c

Loading...
View Options

sys/dev/ral/rt2661.c

Loading...
View Options

sys/dev/ral/rt2860.c

Loading...
View Options

sys/dev/rtwn/if_rtwn.c

Loading...
View Options

sys/dev/usb/wlan/if_rsu.c

Loading...
View Options

sys/dev/usb/wlan/if_rum.c

Loading...
View Options

sys/dev/usb/wlan/if_run.c

Loading...
View Options

sys/dev/usb/wlan/if_uath.c

Loading...
View Options

sys/dev/usb/wlan/if_upgt.c

Loading...
View Options

sys/dev/usb/wlan/if_ural.c

Loading...
View Options

sys/dev/usb/wlan/if_urtw.c

Loading...
View Options

sys/dev/usb/wlan/if_urtwn.c

Loading...
View Options

sys/dev/usb/wlan/if_zyd.c

Loading...