From: Siddh Raman Pant <code@siddh.me> To: Johannes Berg <johannes@sipsolutions.net>, "David S . Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com> Cc: linux-wireless <linux-wireless@vger.kernel.org>, netdev <netdev@vger.kernel.org>, linux-kernel <linux-kernel@vger.kernel.org>, linux-kernel-mentees <linux-kernel-mentees@lists.linuxfoundation.org> Subject: [PATCH] net: Fix UAF in ieee80211_scan_rx() Date: Fri, 1 Jul 2022 20:24:23 +0530 [thread overview] Message-ID: <20220701145423.53208-1-code@siddh.me> (raw) ieee80211_scan_rx() tries to access scan_req->flags after a null check (see line 303 of mac80211/scan.c), but ___cfg80211_scan_done() uses kfree() on the scan_req (see line 991 of wireless/scan.c). This results in a UAF. ieee80211_scan_rx() is called inside a RCU read-critical section initiated by ieee80211_rx_napi() (see line 5043 of mac80211/rx.c). Thus, add an rcu_head to the scan_req struct so as to use kfree_rcu() instead of kfree() so that we don't free during the critical section. Bug report (3): https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d Reported-by: syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com Reported-by: syzbot+6cb476b7c69916a0caca@syzkaller.appspotmail.com Reported-by: syzbot+9250865a55539d384347@syzkaller.appspotmail.com Signed-off-by: Siddh Raman Pant <code@siddh.me> --- include/net/cfg80211.h | 2 ++ net/wireless/scan.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 6d02e12e4702..ba4a49884de8 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -2368,6 +2368,7 @@ struct cfg80211_scan_6ghz_params { * @n_6ghz_params: number of 6 GHz params * @scan_6ghz_params: 6 GHz params * @bssid: BSSID to scan for (most commonly, the wildcard BSSID) + * @rcu_head: (internal) RCU head to use for freeing */ struct cfg80211_scan_request { struct cfg80211_ssid *ssids; @@ -2397,6 +2398,7 @@ struct cfg80211_scan_request { bool scan_6ghz; u32 n_6ghz_params; struct cfg80211_scan_6ghz_params *scan_6ghz_params; + struct rcu_head rcu_head; /* keep last */ struct ieee80211_channel *channels[]; diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 6d82bd9eaf8c..638b2805222c 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -988,7 +988,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, kfree(rdev->int_scan_req); rdev->int_scan_req = NULL; - kfree(rdev->scan_req); + kfree_rcu(rdev->scan_req, rcu_head); rdev->scan_req = NULL; if (!send_message) -- 2.35.1
WARNING: multiple messages have this Message-ID (diff)
From: Siddh Raman Pant <code@siddh.me> To: Johannes Berg <johannes@sipsolutions.net>, "David S . Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com> Cc: netdev <netdev@vger.kernel.org>, linux-wireless <linux-wireless@vger.kernel.org>, linux-kernel <linux-kernel@vger.kernel.org>, linux-kernel-mentees <linux-kernel-mentees@lists.linuxfoundation.org> Subject: [PATCH] net: Fix UAF in ieee80211_scan_rx() Date: Fri, 1 Jul 2022 20:24:23 +0530 [thread overview] Message-ID: <20220701145423.53208-1-code@siddh.me> (raw) ieee80211_scan_rx() tries to access scan_req->flags after a null check (see line 303 of mac80211/scan.c), but ___cfg80211_scan_done() uses kfree() on the scan_req (see line 991 of wireless/scan.c). This results in a UAF. ieee80211_scan_rx() is called inside a RCU read-critical section initiated by ieee80211_rx_napi() (see line 5043 of mac80211/rx.c). Thus, add an rcu_head to the scan_req struct so as to use kfree_rcu() instead of kfree() so that we don't free during the critical section. Bug report (3): https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d Reported-by: syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com Reported-by: syzbot+6cb476b7c69916a0caca@syzkaller.appspotmail.com Reported-by: syzbot+9250865a55539d384347@syzkaller.appspotmail.com Signed-off-by: Siddh Raman Pant <code@siddh.me> --- include/net/cfg80211.h | 2 ++ net/wireless/scan.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 6d02e12e4702..ba4a49884de8 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -2368,6 +2368,7 @@ struct cfg80211_scan_6ghz_params { * @n_6ghz_params: number of 6 GHz params * @scan_6ghz_params: 6 GHz params * @bssid: BSSID to scan for (most commonly, the wildcard BSSID) + * @rcu_head: (internal) RCU head to use for freeing */ struct cfg80211_scan_request { struct cfg80211_ssid *ssids; @@ -2397,6 +2398,7 @@ struct cfg80211_scan_request { bool scan_6ghz; u32 n_6ghz_params; struct cfg80211_scan_6ghz_params *scan_6ghz_params; + struct rcu_head rcu_head; /* keep last */ struct ieee80211_channel *channels[]; diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 6d82bd9eaf8c..638b2805222c 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -988,7 +988,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, kfree(rdev->int_scan_req); rdev->int_scan_req = NULL; - kfree(rdev->scan_req); + kfree_rcu(rdev->scan_req, rcu_head); rdev->scan_req = NULL; if (!send_message) -- 2.35.1 _______________________________________________ Linux-kernel-mentees mailing list Linux-kernel-mentees@lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
next reply other threads:[~2022-07-01 15:11 UTC|newest] Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-07-01 14:54 Siddh Raman Pant [this message] 2022-07-01 14:54 ` [PATCH] net: Fix UAF in ieee80211_scan_rx() Siddh Raman Pant 2022-07-07 11:36 ` Ping: " Siddh Raman Pant via Linux-kernel-mentees 2022-07-07 11:36 ` Siddh Raman Pant 2022-07-07 11:50 ` Greg KH 2022-07-07 11:50 ` Greg KH 2022-07-07 11:59 ` Siddh Raman Pant via Linux-kernel-mentees 2022-07-07 11:59 ` Siddh Raman Pant 2022-07-26 9:55 ` Kalle Valo 2022-07-26 9:55 ` Kalle Valo 2022-07-26 11:50 ` Siddh Raman Pant 2022-07-26 11:50 ` Siddh Raman Pant via Linux-kernel-mentees 2022-07-26 10:07 ` Eric Dumazet 2022-07-26 10:07 ` Eric Dumazet via Linux-kernel-mentees 2022-07-26 12:16 ` Siddh Raman Pant via Linux-kernel-mentees 2022-07-26 12:16 ` Siddh Raman Pant
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220701145423.53208-1-code@siddh.me \ --to=code@siddh.me \ --cc=davem@davemloft.net \ --cc=edumazet@google.com \ --cc=johannes@sipsolutions.net \ --cc=kuba@kernel.org \ --cc=linux-kernel-mentees@lists.linuxfoundation.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-wireless@vger.kernel.org \ --cc=netdev@vger.kernel.org \ --cc=pabeni@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.