[Bug 269323] potential NULL dereference in ieee80211_send_probereq()

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=269323

            Bug ID: 269323
           Summary: potential NULL dereference in
                    ieee80211_send_probereq()
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: wireless
          Assignee: wireless@FreeBSD.org
          Reporter: rtm@lcs.mit.edu
 Attachment #239907 text/plain
         mime type:

Created attachment 239907
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=239907&action=edit
inject an 80211 packet that provokes a NULL deref in ieee80211_send_probereq()

In response to an arriving packet, adhoc_input() in ieee80211_adhoc.c
can set ni to NULL and then pass it to ieee80211_send_probereq(),
which tries to dereference it.

                                if (ieee80211_ibss_node_check_new(ni, &scan)) {
                                  ...;
                                } else
                                  ni = NULL;

                                if (! (ic->ic_flags & IEEE80211_F_SCAN)){
                                        ieee80211_send_probereq(ni, /* node */
                                                vap->iv_myaddr, /* SA */
                                                ni->ni_macaddr, /* DA */
                                                vap->iv_bss->ni_bssid, /* BSSID
\
*/
                                                vap->iv_bss->ni_essid,
                                                vap->iv_bss->ni_esslen); /*
SSID\
 */
                                }

I've attached a demo, which needs to be run twice:

# cc wtap2a.c
# ./a.out
# ./a.out
...
panic: Fatal page fault at 0xffffffc00043afea: 0000000000000000
panic() at panic+0x2a
page_fault_handler() at page_fault_handler+0x1d6
do_trap_supervisor() at do_trap_supervisor+0x74
cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x70
--- exception 13, tval = 0
ieee80211_send_probereq() at ieee80211_send_probereq+0x20
adhoc_recv_mgmt() at adhoc_recv_mgmt+0x5b8
wtap_recv_mgmt() at wtap_recv_mgmt+0x28
adhoc_input() at adhoc_input+0x990
ieee80211_input_mimo() at ieee80211_input_mimo+0x6e
ieee80211_input_mimo_all() at ieee80211_input_mimo_all+0x52
ieee80211_input_all() at ieee80211_input_all+0x44
.LBB2_14() at .LBB2_14+0x1e
taskqueue_run_locked() at taskqueue_run_locked+0x96
taskqueue_thread_loop() at taskqueue_thread_loop+0x62
fork_exit() at fork_exit+0x80
fork_trampoline() at fork_trampoline+0xa

-- 
You are receiving this mail because:
You are the assignee for the bug.