|
 |
b645d2 |
From 5db86df6a849684fda6a7ee53978a1ba931848cb Mon Sep 17 00:00:00 2001
|
|
|
b645d2 |
Message-Id: <5db86df6a849684fda6a7ee53978a1ba931848cb.1495014490.git.davide.caratti@gmail.com>
|
|
|
b645d2 |
From: Davide Caratti <davide.caratti@gmail.com>
|
|
|
b645d2 |
Date: Fri, 24 Mar 2017 10:25:24 +0100
|
|
|
b645d2 |
Subject: [PATCH] macsec_linux: Fix NULL pointer dereference on error cases
|
|
|
b645d2 |
|
|
|
b645d2 |
In case wpa_supplicant is using driver_macsec_linux, but macsec module
|
|
|
b645d2 |
is not (yet) loaded in the kernel, nl_socket_alloc() fails and drv->sk
|
|
|
b645d2 |
is NULL. In this case, don't call libnl functions rntl_link_add() or
|
|
|
b645d2 |
rtnl_link_change() using such NULL pointer, to prevent program from
|
|
|
b645d2 |
getting segmentation faults like:
|
|
|
b645d2 |
|
|
|
b645d2 |
Program received signal SIGSEGV, Segmentation fault.
|
|
|
b645d2 |
nl_socket_get_local_port (sk=sk@entry=0x0) at socket.c:365
|
|
|
b645d2 |
365 if (sk->s_local.nl_pid == 0) {
|
|
|
b645d2 |
(gdb) p sk
|
|
|
b645d2 |
$1 = (const struct nl_sock *) 0x0
|
|
|
b645d2 |
(gdb) bt
|
|
|
b645d2 |
#0 nl_socket_get_local_port (sk=sk@entry=0x0) at socket.c:365
|
|
|
b645d2 |
#1 0x00007ffff79c56a0 in nl_complete_msg (sk=sk@entry=0x0,
|
|
|
b645d2 |
msg=msg@entry=0x55555595a1f0) at nl.c:491
|
|
|
b645d2 |
#2 0x00007ffff79c56d1 in nl_send_auto (sk=sk@entry=0x0,
|
|
|
b645d2 |
msg=msg@entry=0x55555595a1f0) at nl.c:522
|
|
|
b645d2 |
#3 0x00007ffff79c652f in nl_send_sync (sk=sk@entry=0x0,
|
|
|
b645d2 |
msg=0x55555595a1f0) at nl.c:556
|
|
|
b645d2 |
#4 0x00007ffff755faf5 in rtnl_link_add (sk=0x0,
|
|
|
b645d2 |
link=link@entry=0x55555595b0f0, flags=flags@entry=1024) at route/link.c:1548
|
|
|
b645d2 |
#5 0x000055555567a298 in macsec_drv_create_transmit_sc (priv=0x55555593b130,
|
|
|
b645d2 |
sc=0x55555593b320, conf_offset=<optimized out>) at ../src/drivers/driver_macsec_linux.c:998
|
|
|
b645d2 |
|
|
|
b645d2 |
Signed-off-by: Davide Caratti <davide.caratti@gmail.com>
|
|
|
b645d2 |
---
|
|
|
b645d2 |
src/drivers/driver_macsec_linux.c | 11 +++++++++++
|
|
|
b645d2 |
1 file changed, 11 insertions(+)
|
|
|
b645d2 |
|
|
|
b645d2 |
diff --git a/src/drivers/driver_macsec_linux.c b/src/drivers/driver_macsec_linux.c
|
|
|
b645d2 |
index 5dab77a..0694e60 100644
|
|
|
b645d2 |
--- a/src/drivers/driver_macsec_linux.c
|
|
|
b645d2 |
+++ b/src/drivers/driver_macsec_linux.c
|
|
|
b645d2 |
@@ -168,6 +168,9 @@ static int try_commit(struct macsec_drv_data *drv)
|
|
|
b645d2 |
{
|
|
|
b645d2 |
int err;
|
|
|
b645d2 |
|
|
|
b645d2 |
+ if (!drv->sk)
|
|
|
b645d2 |
+ return 0;
|
|
|
b645d2 |
+
|
|
|
b645d2 |
if (!drv->link)
|
|
|
b645d2 |
return 0;
|
|
|
b645d2 |
|
|
|
b645d2 |
@@ -982,6 +985,11 @@ static int macsec_drv_create_transmit_sc(
|
|
|
b645d2 |
|
|
|
b645d2 |
wpa_printf(MSG_DEBUG, "%s", __func__);
|
|
|
b645d2 |
|
|
|
b645d2 |
+ if (!drv->sk) {
|
|
|
b645d2 |
+ wpa_printf(MSG_ERROR, DRV_PREFIX "NULL rtnl socket");
|
|
|
b645d2 |
+ return -1;
|
|
|
b645d2 |
+ }
|
|
|
b645d2 |
+
|
|
|
b645d2 |
link = rtnl_link_macsec_alloc();
|
|
|
b645d2 |
if (!link) {
|
|
|
b645d2 |
wpa_printf(MSG_ERROR, DRV_PREFIX "couldn't allocate link");
|
|
|
b645d2 |
@@ -1048,6 +1056,9 @@ static int macsec_drv_delete_transmit_sc(void *priv, struct transmit_sc *sc)
|
|
|
b645d2 |
|
|
|
b645d2 |
wpa_printf(MSG_DEBUG, "%s", __func__);
|
|
|
b645d2 |
|
|
|
b645d2 |
+ if (!drv->sk)
|
|
|
b645d2 |
+ return 0;
|
|
|
b645d2 |
+
|
|
|
b645d2 |
if (!drv->created_link) {
|
|
|
b645d2 |
rtnl_link_put(drv->link);
|
|
|
b645d2 |
drv->link = NULL;
|
|
|
b645d2 |
--
|
|
|
b645d2 |
2.7.4
|
|
|
b645d2 |
|