lkml.org 
[lkml]   [2018]   [Nov]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.18 049/150] cfg80211: fix use-after-free in reg_process_hint()
    Date
    4.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit 1db58529454742f67ebd96e3588315e880b72837 ]

    reg_process_hint_country_ie() can free regulatory_request and return
    REG_REQ_ALREADY_SET. We shouldn't use regulatory_request after it's
    called. KASAN error was observed when this happens.

    BUG: KASAN: use-after-free in reg_process_hint+0x839/0x8aa [cfg80211]
    Read of size 4 at addr ffff8800c430d434 by task kworker/1:3/89
    <snipped>
    Workqueue: events reg_todo [cfg80211]
    Call Trace:
    dump_stack+0xc1/0x10c
    ? _atomic_dec_and_lock+0x1ad/0x1ad
    ? _raw_spin_lock_irqsave+0xa0/0xd2
    print_address_description+0x86/0x26f
    ? reg_process_hint+0x839/0x8aa [cfg80211]
    kasan_report+0x241/0x29b
    reg_process_hint+0x839/0x8aa [cfg80211]
    reg_todo+0x204/0x5b9 [cfg80211]
    process_one_work+0x55f/0x8d0
    ? worker_detach_from_pool+0x1b5/0x1b5
    ? _raw_spin_unlock_irq+0x65/0xdd
    ? _raw_spin_unlock_irqrestore+0xf3/0xf3
    worker_thread+0x5dd/0x841
    ? kthread_parkme+0x1d/0x1d
    kthread+0x270/0x285
    ? pr_cont_work+0xe3/0xe3
    ? rcu_read_unlock_sched_notrace+0xca/0xca
    ret_from_fork+0x22/0x40

    Allocated by task 2718:
    set_track+0x63/0xfa
    __kmalloc+0x119/0x1ac
    regulatory_hint_country_ie+0x38/0x329 [cfg80211]
    __cfg80211_connect_result+0x854/0xadd [cfg80211]
    cfg80211_rx_assoc_resp+0x3bc/0x4f0 [cfg80211]
    smsc95xx v1.0.6
    ieee80211_sta_rx_queued_mgmt+0x1803/0x7ed5 [mac80211]
    ieee80211_iface_work+0x411/0x696 [mac80211]
    process_one_work+0x55f/0x8d0
    worker_thread+0x5dd/0x841
    kthread+0x270/0x285
    ret_from_fork+0x22/0x40

    Freed by task 89:
    set_track+0x63/0xfa
    kasan_slab_free+0x6a/0x87
    kfree+0xdc/0x470
    reg_process_hint+0x31e/0x8aa [cfg80211]
    reg_todo+0x204/0x5b9 [cfg80211]
    process_one_work+0x55f/0x8d0
    worker_thread+0x5dd/0x841
    kthread+0x270/0x285
    ret_from_fork+0x22/0x40
    <snipped>

    Signed-off-by: Yu Zhao <yuzhao@google.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/wireless/reg.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    diff --git a/net/wireless/reg.c b/net/wireless/reg.c
    index 765dedb12361..24cfa2776f50 100644
    --- a/net/wireless/reg.c
    +++ b/net/wireless/reg.c
    @@ -2661,11 +2661,12 @@ static void reg_process_hint(struct regulatory_request *reg_request)
    {
    struct wiphy *wiphy = NULL;
    enum reg_request_treatment treatment;
    + enum nl80211_reg_initiator initiator = reg_request->initiator;

    if (reg_request->wiphy_idx != WIPHY_IDX_INVALID)
    wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);

    - switch (reg_request->initiator) {
    + switch (initiator) {
    case NL80211_REGDOM_SET_BY_CORE:
    treatment = reg_process_hint_core(reg_request);
    break;
    @@ -2683,7 +2684,7 @@ static void reg_process_hint(struct regulatory_request *reg_request)
    treatment = reg_process_hint_country_ie(wiphy, reg_request);
    break;
    default:
    - WARN(1, "invalid initiator %d\n", reg_request->initiator);
    + WARN(1, "invalid initiator %d\n", initiator);
    goto out_free;
    }

    @@ -2698,7 +2699,7 @@ static void reg_process_hint(struct regulatory_request *reg_request)
    */
    if (treatment == REG_REQ_ALREADY_SET && wiphy &&
    wiphy->regulatory_flags & REGULATORY_STRICT_REG) {
    - wiphy_update_regulatory(wiphy, reg_request->initiator);
    + wiphy_update_regulatory(wiphy, initiator);
    wiphy_all_share_dfs_chan_state(wiphy);
    reg_check_channels();
    }
    --
    2.17.1


    \
     
     \ /
      Last update: 2018-11-02 19:41    [W:4.138 / U:1.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site