[lkml]   [2010]   [Oct]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[040/103] mac80211: fix use-after-free
2.6.35-stable review patch.  If anyone has any objections, please let us know.


From: Johannes Berg <>

commit cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963 upstream.

commit 8c0c709eea5cbab97fb464cd68b06f24acc58ee1
Author: Johannes Berg <>
Date: Wed Nov 25 17:46:15 2009 +0100

mac80211: move cmntr flag out of rx flags

moved the CMTR flag into the skb's status, and
in doing so introduced a use-after-free -- when
the skb has been handed to cooked monitors the
status setting will touch now invalid memory.

Additionally, moving it there has effectively
discarded the optimisation -- since the bit is
only ever set on freed SKBs, and those were a
copy, it could never be checked.

For the current release, fixing this properly
is a bit too involved, so let's just remove the
problematic code and leave userspace with one
copy of each frame for each virtual interface.

Signed-off-by: Johannes Berg <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>

net/mac80211/rx.c | 4 ----
1 file changed, 4 deletions(-)

--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2156,9 +2156,6 @@ static void ieee80211_rx_cooked_monitor(
struct net_device *prev_dev = NULL;
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);

- if (status->flag & RX_FLAG_INTERNAL_CMTR)
- goto out_free_skb;
if (skb_headroom(skb) < sizeof(*rthdr) &&
pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
goto out_free_skb;
@@ -2217,7 +2214,6 @@ static void ieee80211_rx_cooked_monitor(
} else
goto out_free_skb;

- status->flag |= RX_FLAG_INTERNAL_CMTR;


 \ /
  Last update: 2010-10-22 21:19    [W:0.238 / U:1.404 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site