[OpenWrt-Commits] r42152 - branches/barrier_breaker/package/network/utils/iwinfo/src

[openwrt-commits]

Author: jow
Date: 2014-08-12 13:15:38 +0200 (Tue, 12 Aug 2014)
New Revision: 42152

Modified:
   branches/barrier_breaker/package/network/utils/iwinfo/src/iwinfo_lua.c
   branches/barrier_breaker/package/network/utils/iwinfo/src/iwinfo_nl80211.c
Log:
BB: package: fix segfault of iwinfo.scanlist("radio0").

This is a bug revealed in r41830.

First, the static variable `char nif[IFNAMSIZ]` of nl80211_phy2ifname()
would be zeroed out if the argument is "wlan0" or the like.  This will
happen in the following call stack.

 nl80211_get_scanlist("radio0", buf, len);
   nl80211_phy2ifname("radio0")                 // return static var nif with 
content "wlan0"
   nl80211_get_scanlist(nif, buf, len);         // tail call
     nl80211_get_mode(nif);
        nl80211_phy2ifname(nif);                // zero out nif

Later we try nl80211_ifadd("") which was supposed to create interface
"tmp.", but that won't happen because nl80211_msg() will put an invalid
ifidx 0 to the nlmsg.

Then iwinfo_ifup() and iwinfo_ifdown() would fail and happily
nl80211_get_scanlist() returned 0 and left *len undefined.

Signed-off-by: Yousong Zhou <yszhou4t...@gmail.com>

Backport of r42151

Modified: branches/barrier_breaker/package/network/utils/iwinfo/src/iwinfo_lua.c
===================================================================
--- branches/barrier_breaker/package/network/utils/iwinfo/src/iwinfo_lua.c      
2014-08-12 11:14:11 UTC (rev 42151)
+++ branches/barrier_breaker/package/network/utils/iwinfo/src/iwinfo_lua.c      
2014-08-12 11:15:38 UTC (rev 42152)
@@ -362,7 +362,7 @@
 /* Wrapper for scan list */
 static int iwinfo_L_scanlist(lua_State *L, int (*func)(const char *, char *, 
int *))
 {
-       int i, x, len;
+       int i, x, len = 0;
        char rv[IWINFO_BUFSIZE];
        char macstr[18];
        const char *ifname = luaL_checkstring(L, 1);

Modified: 
branches/barrier_breaker/package/network/utils/iwinfo/src/iwinfo_nl80211.c
===================================================================
--- branches/barrier_breaker/package/network/utils/iwinfo/src/iwinfo_nl80211.c  
2014-08-12 11:14:11 UTC (rev 42151)
+++ branches/barrier_breaker/package/network/utils/iwinfo/src/iwinfo_nl80211.c  
2014-08-12 11:15:38 UTC (rev 42152)
@@ -215,6 +215,9 @@
        int ifidx = -1, phyidx = -1;
        struct nl80211_msg_conveyor *cv;
 
+       if (ifname == NULL)
+               return NULL;
+
        if (nl80211_init() < 0)
                return NULL;
 
@@ -227,7 +230,8 @@
        else
                ifidx = if_nametoindex(ifname);
 
-       if ((ifidx < 0) && (phyidx < 0))
+       /* Valid ifidx must be greater than 0 */
+       if ((ifidx <= 0) && (phyidx < 0))
                return NULL;
 
        cv = nl80211_new(nls->nl80211, cmd, flags);
@@ -500,12 +504,15 @@
        DIR *d;
        struct dirent *e;
 
+       /* Only accept phy name of the form phy%d or radio%d */
        if (!ifname)
                return NULL;
        else if (!strncmp(ifname, "phy", 3))
                phyidx = atoi(&ifname[3]);
        else if (!strncmp(ifname, "radio", 5))
                phyidx = atoi(&ifname[5]);
+       else
+               return NULL;
 
        memset(nif, 0, sizeof(nif));
 
_______________________________________________
openwrt-commits mailing list
openwrt-commits@lists.openwrt.org
https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-commits