zhhyu7 opened a new pull request, #21341:
URL: https://github.com/apache/nuttx/pull/21341
## Summary
`connected_ap` points to a heap `wifi_sim_bss_s` that
`wifidriver_start_connect()` assigns and `wifidriver_start_disconnect()`
frees. Readers reach it through `wifidriver_sta_is_connected()`, which only
tests `wifidev->state`, so the state check and the dereference are not
atomic. If a connect and a disconnect interleave,
`wifidriver_get_sensitivity()`,
`wifidriver_get_freq()` and `wifidriver_get_bssid()` can pass the state check
and then dereference memory that `free()` has already released.
Add an `ap_lock` mutex to `wifi_sim_s` and hold it around every access to
`connected_ap`: the assignment in `start_connect()`, the `free()` in
`start_disconnect()`, and the three ioctl readers. Initialized in
`wifi_sim_init()`, destroyed in `wifi_sim_remove()`.
File: `drivers/net/wifi_sim.c` (+18)
## Impact
Add ap_lock protection to connect_ap to prevent access to a already
released connect_ap if the Wi-Fi connection is started and then
simultaneously disconnected.
## Testing
`sim:dynconns` with `CONFIG_DRIVERS_WIFI_SIM=y`,
`CONFIG_SIM_WIFIDEV_PSEUDO=y`
and `CONFIG_MM_KASAN=y`. One thread looping STA connect (`SIOCSIWESSID` /
`IW_ESSID_ON`), one looping disconnect (`IW_ESSID_OFF`), and one looping
`SIOCGIWSENS`/`SIOCGIWFREQ`/`SIOCGIWAP` against the same device:
sanity connect ret=0
sanity SIOCGIWSENS ret=0
sanity SIOCGIWFREQ ret=0
sanity SIOCGIWAP ret=0
sanity disconnect ret=0
stress: connect + disconnect + readers, 500 reader iterations
connects=500 disconnects=500 reader_rounds=500
RESULT: survived (no crash)
All ioctl paths return 0 and the run completes with no KASAN report.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
