lkml.org 
[lkml]   [2021]   [Jun]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 091/109] cfg80211: call cfg80211_leave_ocb when switching away from OCB
    Date
    From: Du Cheng <ducheng2@gmail.com>

    [ Upstream commit a64b6a25dd9f984ed05fade603a00e2eae787d2f ]

    If the userland switches back-and-forth between NL80211_IFTYPE_OCB and
    NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), there is a
    chance where the cleanup cfg80211_leave_ocb() is not called. This leads
    to initialization of in-use memory (e.g. init u.ibss while in-use by
    u.ocb) due to a shared struct/union within ieee80211_sub_if_data:

    struct ieee80211_sub_if_data {
    ...
    union {
    struct ieee80211_if_ap ap;
    struct ieee80211_if_vlan vlan;
    struct ieee80211_if_managed mgd;
    struct ieee80211_if_ibss ibss; // <- shares address
    struct ieee80211_if_mesh mesh;
    struct ieee80211_if_ocb ocb; // <- shares address
    struct ieee80211_if_mntr mntr;
    struct ieee80211_if_nan nan;
    } u;
    ...
    }

    Therefore add handling of otype == NL80211_IFTYPE_OCB, during
    cfg80211_change_iface() to perform cleanup when leaving OCB mode.

    link to syzkaller bug:
    https://syzkaller.appspot.com/bug?id=0612dbfa595bf4b9b680ff7b4948257b8e3732d5

    Reported-by: syzbot+105896fac213f26056f9@syzkaller.appspotmail.com
    Signed-off-by: Du Cheng <ducheng2@gmail.com>
    Link: https://lore.kernel.org/r/20210428063941.105161-1-ducheng2@gmail.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/wireless/util.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/net/wireless/util.c b/net/wireless/util.c
    index c4536468dfbe..e7be500b6452 100644
    --- a/net/wireless/util.c
    +++ b/net/wireless/util.c
    @@ -965,6 +965,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
    case NL80211_IFTYPE_MESH_POINT:
    /* mesh should be handled? */
    break;
    + case NL80211_IFTYPE_OCB:
    + cfg80211_leave_ocb(rdev, dev);
    + break;
    default:
    break;
    }
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-06-28 17:04    [W:4.300 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site