lkml.org 
[lkml]   [2022]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 103/389] ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    [ Upstream commit 0ac4827f78c7ffe8eef074bc010e7e34bc22f533 ]

    Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The
    problem was in incorrect htc_handle->drv_priv initialization.

    Probable call trace which can trigger use-after-free:

    ath9k_htc_probe_device()
    /* htc_handle->drv_priv = priv; */
    ath9k_htc_wait_for_target() <--- Failed
    ieee80211_free_hw() <--- priv pointer is freed

    <IRQ>
    ...
    ath9k_hif_usb_rx_cb()
    ath9k_hif_usb_rx_stream()
    RX_STAT_INC() <--- htc_handle->drv_priv access

    In order to not add fancy protection for drv_priv we can move
    htc_handle->drv_priv initialization at the end of the
    ath9k_htc_probe_device() and add helper macro to make
    all *_STAT_* macros NULL safe, since syzbot has reported related NULL
    deref in that macros [1]

    Link: https://syzkaller.appspot.com/bug?id=6ead44e37afb6866ac0c7dd121b4ce07cb665f60 [0]
    Link: https://syzkaller.appspot.com/bug?id=b8101ffcec107c0567a0cd8acbbacec91e9ee8de [1]
    Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
    Reported-and-tested-by: syzbot+03110230a11411024147@syzkaller.appspotmail.com
    Reported-and-tested-by: syzbot+c6dde1f690b60e0b9fbe@syzkaller.appspotmail.com
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
    Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
    Link: https://lore.kernel.org/r/d57bbedc857950659bfacac0ab48790c1eda00c8.1655145743.git.paskripkin@gmail.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/ath/ath9k/htc.h | 10 +++++-----
    drivers/net/wireless/ath/ath9k/htc_drv_init.c | 3 ++-
    2 files changed, 7 insertions(+), 6 deletions(-)

    diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
    index 9f64e32381f9..81107100e368 100644
    --- a/drivers/net/wireless/ath/ath9k/htc.h
    +++ b/drivers/net/wireless/ath/ath9k/htc.h
    @@ -325,11 +325,11 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb)
    }

    #ifdef CONFIG_ATH9K_HTC_DEBUGFS
    -
    -#define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++)
    -#define TX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a)
    -#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++)
    -#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a)
    +#define __STAT_SAFE(expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0)
    +#define TX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++)
    +#define TX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a)
    +#define RX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++)
    +#define RX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a)
    #define CAB_STAT_INC priv->debug.tx_stats.cab_queued++

    #define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++)
    diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
    index 11054c17a9b5..eaaafa64a3ee 100644
    --- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
    +++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
    @@ -944,7 +944,6 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
    priv->hw = hw;
    priv->htc = htc_handle;
    priv->dev = dev;
    - htc_handle->drv_priv = priv;
    SET_IEEE80211_DEV(hw, priv->dev);

    ret = ath9k_htc_wait_for_target(priv);
    @@ -965,6 +964,8 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
    if (ret)
    goto err_init;

    + htc_handle->drv_priv = priv;
    +
    return 0;

    err_init:
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-23 13:24    [W:4.172 / U:1.400 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site