Skip to content

nl80211: fix corrupt scan results from wpa_supplicant#30

Open
wryun wants to merge 1 commit intoopenwrt:masterfrom
wryun:correct-corrupt-scan-results-from-wpa-supplicant
Open

nl80211: fix corrupt scan results from wpa_supplicant#30
wryun wants to merge 1 commit intoopenwrt:masterfrom
wryun:correct-corrupt-scan-results-from-wpa-supplicant

Conversation

@wryun
Copy link

@wryun wryun commented Oct 22, 2025

Without clearing the scanlist entries, it was possible to have bad data remaining from previous calls in the ht_operation/vht_operation fields (not set here). This could cause segfaults in rpcd's iwinfo module, as it was possible that (a) the primary_chan would not be 0 and therefore (b) you would use bad data for chan_width etc. as an index into short-ish array:

if (e->ht_chan_info.primary_chan) {
	t = blobmsg_open_table(&buf, "ht_operation");
	blobmsg_add_u32(&buf, "primary_channel", e->ht_chan_info.primary_chan);
	blobmsg_add_string(&buf, "secondary_channel_offset", ht_secondary_offset[e->ht_chan_info.secondary_chan_off]);
	blobmsg_add_u32(&buf, "channel_width", ht_chan_width[e->ht_chan_info.chan_width]);
	blobmsg_close_table(&buf, t);
}

Without clearing the scanlist entries, it was possible to have bad
data remaining from previous calls in the ht_operation/vht_operation
fields (not set here).  This could cause segfaults in rpcd's iwinfo
module, as it was possible that (a) the primary_chan would not be 0
and therefore (b) you would use bad data for chan_width etc.  as an
index into short-ish array:

	if (e->ht_chan_info.primary_chan) {
		t = blobmsg_open_table(&buf, "ht_operation");
		blobmsg_add_u32(&buf, "primary_channel", e->ht_chan_info.primary_chan);
		blobmsg_add_string(&buf, "secondary_channel_offset", ht_secondary_offset[e->ht_chan_info.secondary_chan_off]);
		blobmsg_add_u32(&buf, "channel_width", ht_chan_width[e->ht_chan_info.chan_width]);
		blobmsg_close_table(&buf, t);
	}

Signed-off-by: James Haggerty <james.haggerty@morsemicro.com>
@Neustradamus
Copy link

@wryun: Nice PR :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants