|
Takashi Iwai |
3f4758 |
From 3bd801b14e0c5d29eeddc7336558beb3344efaa3 Mon Sep 17 00:00:00 2001
|
|
Takashi Iwai |
3f4758 |
From: Markus Theil <markus.theil@tu-ilmenau.de>
|
|
Takashi Iwai |
3f4758 |
Date: Sat, 13 Feb 2021 14:36:53 +0100
|
|
Takashi Iwai |
3f4758 |
Subject: [PATCH] mac80211: fix double free in ibss_leave
|
|
Takashi Iwai |
3f4758 |
Git-commit: 3bd801b14e0c5d29eeddc7336558beb3344efaa3
|
|
Takashi Iwai |
3f4758 |
Patch-mainline: v5.12-rc5
|
|
Takashi Iwai |
3f4758 |
References: git-fixes
|
|
Takashi Iwai |
3f4758 |
|
|
Takashi Iwai |
3f4758 |
Clear beacon ie pointer and ie length after free
|
|
Takashi Iwai |
3f4758 |
in order to prevent double free.
|
|
Takashi Iwai |
3f4758 |
|
|
Takashi Iwai |
3f4758 |
==================================================================
|
|
Takashi Iwai |
3f4758 |
Bug: KASAN: double-free or invalid-free \
|
|
Takashi Iwai |
3f4758 |
in ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876
|
|
Takashi Iwai |
3f4758 |
|
|
Takashi Iwai |
3f4758 |
Cpu: 0 PID: 8472 Comm: syz-executor100 Not tainted 5.11.0-rc6-syzkaller #0
|
|
Takashi Iwai |
3f4758 |
Call Trace:
|
|
Takashi Iwai |
3f4758 |
__dump_stack lib/dump_stack.c:79 [inline]
|
|
Takashi Iwai |
3f4758 |
dump_stack+0x107/0x163 lib/dump_stack.c:120
|
|
Takashi Iwai |
3f4758 |
print_address_description.constprop.0.cold+0x5b/0x2c6 mm/kasan/report.c:230
|
|
Takashi Iwai |
3f4758 |
kasan_report_invalid_free+0x51/0x80 mm/kasan/report.c:355
|
|
Takashi Iwai |
3f4758 |
____kasan_slab_free+0xcc/0xe0 mm/kasan/common.c:341
|
|
Takashi Iwai |
3f4758 |
kasan_slab_free include/linux/kasan.h:192 [inline]
|
|
Takashi Iwai |
3f4758 |
__cache_free mm/slab.c:3424 [inline]
|
|
Takashi Iwai |
3f4758 |
kfree+0xed/0x270 mm/slab.c:3760
|
|
Takashi Iwai |
3f4758 |
ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876
|
|
Takashi Iwai |
3f4758 |
rdev_leave_ibss net/wireless/rdev-ops.h:545 [inline]
|
|
Takashi Iwai |
3f4758 |
__cfg80211_leave_ibss+0x19a/0x4c0 net/wireless/ibss.c:212
|
|
Takashi Iwai |
3f4758 |
__cfg80211_leave+0x327/0x430 net/wireless/core.c:1172
|
|
Takashi Iwai |
3f4758 |
cfg80211_leave net/wireless/core.c:1221 [inline]
|
|
Takashi Iwai |
3f4758 |
cfg80211_netdev_notifier_call+0x9e8/0x12c0 net/wireless/core.c:1335
|
|
Takashi Iwai |
3f4758 |
notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
|
|
Takashi Iwai |
3f4758 |
call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2040
|
|
Takashi Iwai |
3f4758 |
call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
|
|
Takashi Iwai |
3f4758 |
call_netdevice_notifiers net/core/dev.c:2066 [inline]
|
|
Takashi Iwai |
3f4758 |
__dev_close_many+0xee/0x2e0 net/core/dev.c:1586
|
|
Takashi Iwai |
3f4758 |
__dev_close net/core/dev.c:1624 [inline]
|
|
Takashi Iwai |
3f4758 |
__dev_change_flags+0x2cb/0x730 net/core/dev.c:8476
|
|
Takashi Iwai |
3f4758 |
dev_change_flags+0x8a/0x160 net/core/dev.c:8549
|
|
Takashi Iwai |
3f4758 |
dev_ifsioc+0x210/0xa70 net/core/dev_ioctl.c:265
|
|
Takashi Iwai |
3f4758 |
dev_ioctl+0x1b1/0xc40 net/core/dev_ioctl.c:511
|
|
Takashi Iwai |
3f4758 |
sock_do_ioctl+0x148/0x2d0 net/socket.c:1060
|
|
Takashi Iwai |
3f4758 |
sock_ioctl+0x477/0x6a0 net/socket.c:1177
|
|
Takashi Iwai |
3f4758 |
vfs_ioctl fs/ioctl.c:48 [inline]
|
|
Takashi Iwai |
3f4758 |
__do_sys_ioctl fs/ioctl.c:753 [inline]
|
|
Takashi Iwai |
3f4758 |
__se_sys_ioctl fs/ioctl.c:739 [inline]
|
|
Takashi Iwai |
3f4758 |
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739
|
|
Takashi Iwai |
3f4758 |
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
|
|
Takashi Iwai |
3f4758 |
entry_SYSCALL_64_after_hwframe+0x44/0xa9
|
|
Takashi Iwai |
3f4758 |
|
|
Takashi Iwai |
3f4758 |
Reported-by: syzbot+93976391bf299d425f44@syzkaller.appspotmail.com
|
|
Takashi Iwai |
3f4758 |
Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
|
|
Takashi Iwai |
3f4758 |
Link: https://lore.kernel.org/r/20210213133653.367130-1-markus.theil@tu-ilmenau.de
|
|
Takashi Iwai |
3f4758 |
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Takashi Iwai |
3f4758 |
Acked-by: Takashi Iwai <tiwai@suse.de>
|
|
Takashi Iwai |
3f4758 |
|
|
Takashi Iwai |
3f4758 |
---
|
|
Takashi Iwai |
3f4758 |
net/mac80211/ibss.c | 2 ++
|
|
Takashi Iwai |
3f4758 |
1 file changed, 2 insertions(+)
|
|
Takashi Iwai |
3f4758 |
|
|
Takashi Iwai |
3f4758 |
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
|
|
Takashi Iwai |
3f4758 |
index 1f552f374e97..a7ac53a2f00d 100644
|
|
Takashi Iwai |
3f4758 |
--- a/net/mac80211/ibss.c
|
|
Takashi Iwai |
3f4758 |
+++ b/net/mac80211/ibss.c
|
|
Takashi Iwai |
3f4758 |
@@ -1874,6 +1874,8 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
|
|
Takashi Iwai |
3f4758 |
|
|
Takashi Iwai |
3f4758 |
/* remove beacon */
|
|
Takashi Iwai |
3f4758 |
kfree(sdata->u.ibss.ie);
|
|
Takashi Iwai |
3f4758 |
+ sdata->u.ibss.ie = NULL;
|
|
Takashi Iwai |
3f4758 |
+ sdata->u.ibss.ie_len = 0;
|
|
Takashi Iwai |
3f4758 |
|
|
Takashi Iwai |
3f4758 |
/* on the next join, re-program HT parameters */
|
|
Takashi Iwai |
3f4758 |
memset(&ifibss->ht_capa, 0, sizeof(ifibss->ht_capa));
|
|
Takashi Iwai |
3f4758 |
--
|
|
Takashi Iwai |
3f4758 |
2.26.2
|
|
Takashi Iwai |
3f4758 |
|