Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-02 09:01:34 +00:00
Code Issues Packages Projects Releases Wiki Activity
f547fac624
linux/net/wireless
History
Yu Zhao 1db5852945 cfg80211: fix use-after-free in reg_process_hint() 
reg_process_hint_country_ie() can free regulatory_request and return
REG_REQ_ALREADY_SET. We shouldn't use regulatory_request after it's
called. KASAN error was observed when this happens.

BUG: KASAN: use-after-free in reg_process_hint+0x839/0x8aa [cfg80211]
Read of size 4 at addr ffff8800c430d434 by task kworker/1:3/89
<snipped>
Workqueue: events reg_todo [cfg80211]
Call Trace:
 dump_stack+0xc1/0x10c
 ? _atomic_dec_and_lock+0x1ad/0x1ad
 ? _raw_spin_lock_irqsave+0xa0/0xd2
 print_address_description+0x86/0x26f
 ? reg_process_hint+0x839/0x8aa [cfg80211]
 kasan_report+0x241/0x29b
 reg_process_hint+0x839/0x8aa [cfg80211]
 reg_todo+0x204/0x5b9 [cfg80211]
 process_one_work+0x55f/0x8d0
 ? worker_detach_from_pool+0x1b5/0x1b5
 ? _raw_spin_unlock_irq+0x65/0xdd
 ? _raw_spin_unlock_irqrestore+0xf3/0xf3
 worker_thread+0x5dd/0x841
 ? kthread_parkme+0x1d/0x1d
 kthread+0x270/0x285
 ? pr_cont_work+0xe3/0xe3
 ? rcu_read_unlock_sched_notrace+0xca/0xca
 ret_from_fork+0x22/0x40

Allocated by task 2718:
 set_track+0x63/0xfa
 __kmalloc+0x119/0x1ac
 regulatory_hint_country_ie+0x38/0x329 [cfg80211]
 __cfg80211_connect_result+0x854/0xadd [cfg80211]
 cfg80211_rx_assoc_resp+0x3bc/0x4f0 [cfg80211]
smsc95xx v1.0.6
 ieee80211_sta_rx_queued_mgmt+0x1803/0x7ed5 [mac80211]
 ieee80211_iface_work+0x411/0x696 [mac80211]
 process_one_work+0x55f/0x8d0
 worker_thread+0x5dd/0x841
 kthread+0x270/0x285
 ret_from_fork+0x22/0x40

Freed by task 89:
 set_track+0x63/0xfa
 kasan_slab_free+0x6a/0x87
 kfree+0xdc/0x470
 reg_process_hint+0x31e/0x8aa [cfg80211]
 reg_todo+0x204/0x5b9 [cfg80211]
 process_one_work+0x55f/0x8d0
 worker_thread+0x5dd/0x841
 kthread+0x270/0x285
 ret_from_fork+0x22/0x40
<snipped>

Signed-off-by: Yu Zhao <yuzhao@google.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2018-10-01 09:14:03 +02:00
..
certs cfg80211: ship certificates as hex files 2017-12-19 09:28:01 +01:00
.gitignore cfg80211: implement regdb signature checking 2017-10-11 14:24:24 +02:00
ap.c nl80211: Add SOCKET_OWNER support to START_AP 2018-03-29 10:47:28 +02:00
chan.c cfg80211: enable use of non-cleared DFS channels for DFS offload 2018-03-29 10:21:35 +02:00
core.c This round's updates: 2018-06-30 21:08:12 +09:00
core.h cfg80211: track time using boottime 2018-06-29 09:49:28 +02:00
debugfs.c cfg80211 debugfs: Cleanup some checkpatch issues 2017-02-08 09:15:59 +01:00
debugfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ethtool.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ibss.c nl80211: Add SOCKET_OWNER support to JOIN_IBSS 2018-03-29 10:36:22 +02:00
Kconfig cfg80211: add missing dependency to CFG80211 suboptions 2018-02-27 10:54:12 +01:00
lib80211_crypt_ccmp.c lib80211: ratelimit key index mismatch 2015-12-04 14:43:32 +01:00
lib80211_crypt_tkip.c wireless/lib80211: Convert from ahash to shash 2018-07-24 09:17:20 +02:00
lib80211_crypt_wep.c lib80211: Use skcipher and ahash 2016-01-27 20:36:03 +08:00
lib80211.c treewide: setup_timer() -> timer_setup() 2017-11-21 15:57:07 -08:00
Makefile cfg80211: ship certificates as hex files 2017-12-19 09:28:01 +01:00
mesh.c nl80211: Add SOCKET_OWNER support to JOIN_MESH 2018-03-29 10:38:24 +02:00
mlme.c cfg80211: fix CAC_STARTED event handling 2018-03-29 10:21:16 +02:00
nl80211.c nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds 2018-09-27 11:44:44 +02:00
nl80211.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-11-04 09:26:51 +09:00
ocb.c cfg80211: ocb: Fix null pointer deref if join_ocb is unimplemented 2015-12-04 14:43:32 +01:00
of.c cfg80211: support ieee80211-freq-limit DT property 2017-01-06 14:01:13 +01:00
radiotap.c cfg80211: add radiotap VHT info to rtap_namespace_sizes 2016-02-24 09:04:41 +01:00
rdev-ops.h cfg80211: Expose TXQ stats and parameters to userspace 2018-05-08 13:19:24 +02:00
reg.c cfg80211: fix use-after-free in reg_process_hint() 2018-10-01 09:14:03 +02:00
reg.h cfg80211: implement regdb signature checking 2017-10-11 14:24:24 +02:00
scan.c cfg80211: Address some corner cases in scan result channel updating 2018-09-10 09:13:09 +02:00
sme.c nl80211: add FILS related parameters to ROAM event 2018-05-23 11:19:02 +02:00
sysfs.c cfg80211: track time using boottime 2018-06-29 09:49:28 +02:00
sysfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
trace.c
trace.h nl80211/mac80211: allow non-linear skb in rx_control_port 2018-07-06 14:34:42 +02:00
util.c Here are quite a large number of fixes, notably: 2018-09-03 22:12:02 -07:00
wext-compat.c cfg80211: fix wext-compat memory leak 2018-10-01 09:11:36 +02:00
wext-compat.h cfg80211-wext: export symbols only when needed 2015-02-28 21:31:09 +01:00
wext-core.c net: Don't take rtnl_lock() in wireless_nlevent_flush() 2018-03-29 13:47:53 -04:00
wext-priv.c
wext-proc.c proc: introduce proc_create_net{,_data} 2018-05-16 07:24:30 +02:00
wext-sme.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
wext-spy.c