Silent uint16_t truncation of iv_swbmiss_period can yield zero (callout flood DoS)
Summary
tdma_newstate computes swbmiss period via IEEE80211_TU_TO_TICKS() returns uint64_t but stored in iv_swbmiss_period uint16_t. Truncation can yield period=0 causing callout_reset fire every tick flooding taskqueue with bmiss tasks rapid beacon-miss->scan->rejoin cycling. Attacker as TDMA master controls tdma_bintval and tdma_slotlen via beacon IE. Zero-producing example hz=1000 bmissthreshold=5 bintval=128 slotlen=256: inner TU=64000 TU_TO_TICKS=65536 uint16_t truncates to 0. [VERIFIED pass2: reproduced at real hz 100 - bintval 250 slotcnt 8 slotlen 32768 gives TU_TO_TICKS 65536 wrapping uint16 period to 0, callout fires 19 per 200ms vs 0; period-floor fix]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2579 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| rig.c | — | 4.7 KB | view raw | |
| build.sh | — | 94 B | view raw | |
| run.log | — | 679 B | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
tdma run: inner TU=640000 TU_TO_TICKS=65536 -> uint16 period=0 + fires in 200ms: 19 vs 0
PoC changes
verbatim expression evaluated in-kernel with real hz + real callout flood A/B
Verified recommended fix
floor iv_swbmiss_period at 1 tick after the store (in combined fix kernel)
Verdict
ieee80211_tdma.c:284-286 stores IEEE80211_TU_TO_TICKS(2bmissthresholdbintval((slotcntslotlen)/1024)) -- uint64_t -- into uint16_t iv_swbmiss_period. With THIS GUESTS REAL hz=100 and all in-range parameters (bmissthreshold=5, bintval=250, slotcnt=8, slotlen=32768): inner TU=640000, TU_TO_TICKS=65536, (uint16_t)65536 == 0. callout_reset(..., 0, ieee80211_swbmiss) then re-arms every tick: the harness callout fired 19 times in 200 ms with period 0 vs 0 times with a sane 6553-tick period -- beacon-miss storm/taskqueue flood. (The findings example assumed hz=1000; the hz=100 parameter set above produces the same 2^16 truncation on the stock clock.) Reachability: TDMA mode requires wlan_tdma + master-controlled beacon IEs (root-configured radio environment).
No comments yet.