* [PATCH] mac80211: fix minstrel single-rate memory corruption
@ 2009-06-05 12:21 Bob Copeland
2009-06-05 14:04 ` Felix Fietkau
2009-06-07 23:06 ` Thiemo Nagel
0 siblings, 2 replies; 4+ messages in thread
From: Bob Copeland @ 2009-06-05 12:21 UTC (permalink / raw)
To: linville
Cc: linux-wireless, linux-kernel, nbd, rathamahata, ognjen.maric,
rjw, Bob Copeland, stable
The minstrel rate controller periodically looks up rate indexes in
a sampling table. When accessing a specific row and column, minstrel
correctly does a bounds check which, on the surface, appears to handle
the case where mi->n_rates < 2. However, mi->sample_idx is actually
defined as an unsigned, so the right hand side is taken to be a huge
positive number when negative, and the check will always fail.
Consequently, the RC will overrun the array and cause random memory
corruption when communicating with a peer that has only a single rate.
The max value of mi->sample_idx is around 25 so casting to int should
have no ill effects.
Without the change, uptime is a few minutes under load with an AP
that has a single hard-coded rate, and both the AP and STA could
potentially crash. With the change, both lasted 12 hours with a
steady load.
Thanks to Ognjen Maric for providing the single-rate clue so I could
reproduce this.
This fixes http://bugzilla.kernel.org/show_bug.cgi?id=12490 on the
regression list (also http://bugzilla.kernel.org/show_bug.cgi?id=13000).
Cc: stable@kernel.org
Reported-by: Sergey S. Kostyliov <rathamahata@gmail.com>
Reported-by: Ognjen Maric <ognjen.maric@gmail.com>
Signed-off-by: Bob Copeland <me@bobcopeland.com>
---
John & Felix, the patch itself may be too subtle so feel free to do it a
different way. However this is as minimal as it gets so I hope it can
be applied quickly to stable, and mainline if not too late.
net/mac80211/rc80211_minstrel.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index d9233ec..2681dfa 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -216,7 +216,7 @@ minstrel_get_next_sample(struct minstrel_sta_info *mi)
unsigned int sample_ndx;
sample_ndx = SAMPLE_TBL(mi, mi->sample_idx, mi->sample_column);
mi->sample_idx++;
- if (mi->sample_idx > (mi->n_rates - 2)) {
+ if ((int) mi->sample_idx > (mi->n_rates - 2)) {
mi->sample_idx = 0;
mi->sample_column++;
if (mi->sample_column >= SAMPLE_COLUMNS)
--
1.5.4.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] mac80211: fix minstrel single-rate memory corruption
2009-06-05 12:21 [PATCH] mac80211: fix minstrel single-rate memory corruption Bob Copeland
@ 2009-06-05 14:04 ` Felix Fietkau
2009-06-05 14:21 ` Bob Copeland
2009-06-07 23:06 ` Thiemo Nagel
1 sibling, 1 reply; 4+ messages in thread
From: Felix Fietkau @ 2009-06-05 14:04 UTC (permalink / raw)
To: Bob Copeland
Cc: linville, linux-wireless, linux-kernel, rathamahata,
ognjen.maric, rjw, stable
Bob Copeland wrote:
> The minstrel rate controller periodically looks up rate indexes in
> a sampling table. When accessing a specific row and column, minstrel
> correctly does a bounds check which, on the surface, appears to handle
> the case where mi->n_rates < 2. However, mi->sample_idx is actually
> defined as an unsigned, so the right hand side is taken to be a huge
> positive number when negative, and the check will always fail.
>
> Consequently, the RC will overrun the array and cause random memory
> corruption when communicating with a peer that has only a single rate.
> The max value of mi->sample_idx is around 25 so casting to int should
> have no ill effects.
>
> Without the change, uptime is a few minutes under load with an AP
> that has a single hard-coded rate, and both the AP and STA could
> potentially crash. With the change, both lasted 12 hours with a
> steady load.
>
> Thanks to Ognjen Maric for providing the single-rate clue so I could
> reproduce this.
>
> This fixes http://bugzilla.kernel.org/show_bug.cgi?id=12490 on the
> regression list (also http://bugzilla.kernel.org/show_bug.cgi?id=13000).
>
> Cc: stable@kernel.org
> Reported-by: Sergey S. Kostyliov <rathamahata@gmail.com>
> Reported-by: Ognjen Maric <ognjen.maric@gmail.com>
> Signed-off-by: Bob Copeland <me@bobcopeland.com>
> ---
>
> John & Felix, the patch itself may be too subtle so feel free to do it a
> different way. However this is as minimal as it gets so I hope it can
> be applied quickly to stable, and mainline if not too late.
How about changing the type of sample_idx to signed instead of casting
it? It's just a cosmetic thing, so even if you leave at this you get my
Acked-by: Felix Fietkau <nbd@openwrt.org>
- Felix
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] mac80211: fix minstrel single-rate memory corruption
2009-06-05 14:04 ` Felix Fietkau
@ 2009-06-05 14:21 ` Bob Copeland
0 siblings, 0 replies; 4+ messages in thread
From: Bob Copeland @ 2009-06-05 14:21 UTC (permalink / raw)
To: Felix Fietkau
Cc: linville, linux-wireless, linux-kernel, rathamahata,
ognjen.maric, rjw, stable
On Fri, Jun 5, 2009 at 10:04 AM, Felix Fietkau<nbd@openwrt.org> wrote:
>> John & Felix, the patch itself may be too subtle so feel free to do it a
>> different way. However this is as minimal as it gets so I hope it can
>> be applied quickly to stable, and mainline if not too late.
>
> How about changing the type of sample_idx to signed instead of casting
> it? It's just a cosmetic thing, so even if you leave at this you get my
Yeah, that is a better option for 2.6.31. I would be a bit more
comfortable with this version for now though since it's exactly
the code I tested.
> Acked-by: Felix Fietkau <nbd@openwrt.org>
Thanks!
--
Bob Copeland %% www.bobcopeland.com
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] mac80211: fix minstrel single-rate memory corruption
2009-06-05 12:21 [PATCH] mac80211: fix minstrel single-rate memory corruption Bob Copeland
2009-06-05 14:04 ` Felix Fietkau
@ 2009-06-07 23:06 ` Thiemo Nagel
1 sibling, 0 replies; 4+ messages in thread
From: Thiemo Nagel @ 2009-06-07 23:06 UTC (permalink / raw)
To: Bob Copeland
Cc: linville, linux-wireless, linux-kernel, nbd, rathamahata,
ognjen.maric, rjw, stable
> This fixes http://bugzilla.kernel.org/show_bug.cgi?id=12490 on the
> regression list (also http://bugzilla.kernel.org/show_bug.cgi?id=13000).
The patch works well. No kernel panics anymore. You made my day!
Thank you,
Thiemo
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2009-06-07 23:37 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-06-05 12:21 [PATCH] mac80211: fix minstrel single-rate memory corruption Bob Copeland
2009-06-05 14:04 ` Felix Fietkau
2009-06-05 14:21 ` Bob Copeland
2009-06-07 23:06 ` Thiemo Nagel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).