Re: brcmfmac: driver crash with iOS 18.6.1, potential DoS

On 9/26/2025 3:36 AM, Hsien Chou wrote:
> Hi Arend,
> 
> Attachement is the kernel .config file. Thanks for the quick response!

Thanks. That helps and using gdb I can determine the location in which 
the null deref happened:

drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c:
1561		if (p2p_af->subtype == P2P_AF_PRESENCE_RSP)
    0x0000000000016d18 <+560>:	ldr	x0, [sp, #112]

1562			vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif;
    0x0000000000016d1c <+564>:	add	x1, x20, #0x48

1563		else
1564			vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
1565	
1566		err = brcmf_fil_bsscfg_data_set(vif->ifp, "actframe", af_params,
    0x0000000000016d20 <+568>:	mov	w3, #0x724                 	// #1828

1561		if (p2p_af->subtype == P2P_AF_PRESENCE_RSP)
    0x0000000000016d24 <+572>:	ldrb	w2, [x0, #5]                 <==

1562			vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif;
    0x0000000000016d28 <+576>:	add	x0, x20, #0x38
    0x0000000000016d2c <+580>:	cmp	w2, #0x2

x0 is indeed 0 so p2p_af is NULL. Offset of subtype field is indeed #5:

/* offset    |  size */  type = struct brcmf_p2p_action_frame {
/*    0      |     1 */    u8 category;
/*    1      |     3 */    u8 oui[3];
/*    4      |     1 */    u8 type;
/*    5      |     1 */    u8 subtype;
/*    6      |     1 */    u8 dialog_token;
/*    7      |     0 */    u8 elts[];

                            /* total size (bytes):    7 */
                          }

What does not make sense to me is that the logs says:

Sep 02 17:24:32 raspi kernel: Unable to handle kernel NULL pointer 
dereference at virtual address 0000000000000000

Given the instruction in brcmf_p2p_send_action_frame+0x23c (+572) I 
would expect the kernel to complain about virtual address 0000000000000005.

Also not clear how p2p_af can be NULL.

	p2p_af = (struct brcmf_p2p_action_frame *)af_params->action_frame.data;

struct brcmf_fil_action_frame_le {
	u8	da[ETH_ALEN];
	__le16	len;
	__le32	packet_id;
	u8	data[BRCMF_FIL_ACTION_FRAME_SIZE];
};

struct brcmf_fil_af_params_le {
	__le32					channel;
	__le32					dwell_time;
	u8					bssid[ETH_ALEN];
	u8					pad[2];
	struct brcmf_fil_action_frame_le	action_frame;
};

so the data field in action_frame is a sized array element so it is not 
possible that it has NULL address.

So it seems I could not reproduce the build reliably. I used GCC13 iso 
GCC12 as given in the .config, but I don't expect that could explain the 
difference.

Regards,
Arend

> Regards,
> 
> --
> Ken Chou
> 
> Arend van Spriel <[email protected]> 於 2025年9月26日 週五 上午2:31寫道：
>>
>> On 9/24/2025 4:53 AM, Hsien Chou wrote:
>>> Hi Arend and everyone on the mailing lists,
>>>
>>> I'm reporting a driver crash in brcmfmac that can be triggered by an
>>> iPhone with iOS 18.6.1 or newer. This issue *allows a remote,
>>> unauthenticated device* to crash the Wi-Fi driver, leading to a denial
>>> of service.
>>>
>>> The full details, including complete crash logs and a step-by-step
>>> reproduction guide, are available on the GitHub issue page:
>>> https://github.com/raspberrypi/linux/issues/7033 <https://github.com/
>>> raspberrypi/linux/issues/7033>
>>>
>>> For a quick reference, here are the key details:
>>> * *Affected devices:* A Raspberry Pi running as a Wi-Fi access point.
>>> * *Trigger:* An iPhone with iOS > 18.6.1 attempts to view the properties
>>> of the Wi-Fi network.
>>> * *Root cause (based on preliminary analysis):* The driver panics,
>>> possibly due to a malformed or unexpected frame.
>>>
>>> Please let me know if you need any additional information to debug this
>>> issue.
>>
>> Having the kernel .config file from the Raspberry Pi would be helpful
>> reproducing the driver build. Can you provide that?
>>
>> Regards,
>> Arend