From: Jakub Kicinski <kuba@kernel.org>
To: Siddh Raman Pant <code@siddh.me>
Cc: syzbot+9250865a55539d384347
<syzbot+9250865a55539d384347@syzkaller.appspotmail.com>,
syzbot+6cb476b7c69916a0caca
<syzbot+6cb476b7c69916a0caca@syzkaller.appspotmail.com>,
linux-wireless <linux-wireless@vger.kernel.org>,
linux-kernel <linux-kernel@vger.kernel.org>,
syzbot+f9acff9bf08a845f225d
<syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com>,
eric dumazet <edumazet@google.com>,
netdev <netdev@vger.kernel.org>,
johannes berg <johannes@sipsolutions.net>,
paolo abeni <pabeni@redhat.com>,
linux-kernel-mentees
<linux-kernel-mentees@lists.linuxfoundation.org>,
"david s. miller" <davem@davemloft.net>
Subject: Re: [PATCH v2] wifi: cfg80211: Fix UAF in ieee80211_scan_rx()
Date: Fri, 12 Aug 2022 12:25:09 -0700 [thread overview]
Message-ID: <20220812122509.281f0536@kernel.org> (raw)
In-Reply-To: <18292e1dcd8.2359a549180213.8185874405406307019@siddh.me>
On Fri, 12 Aug 2022 21:57:31 +0530 Siddh Raman Pant wrote:
> On Fri, 12 Aug 2022 20:57:58 +0530 Greg KH wrote:
> > rcu just delays freeing of an object, you might just be delaying the
> > race condition. Just moving a single object to be freed with rcu feels
> > very odd if you don't have another reference somewhere.
>
> As mentioned in patch message, in net/mac80211/scan.c, we have:
> void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb)
> {
> ...
> scan_req = rcu_dereference(local->scan_req);
> sched_scan_req = rcu_dereference(local->sched_scan_req);
>
> if (scan_req)
> scan_req_flags = scan_req->flags;
> ...
> }
>
> So scan_req is probably supposed to be protected by RCU.
>
> Also, in ieee80211_local's definition at net/mac80211/ieee80211_i.h, we have:
> struct cfg80211_scan_request __rcu *scan_req;
>
> Thus, scan_req is indeed supposed to be protected by RCU, which this patch
> addresses by adding a RCU head to the type's struct, and using kfree_rcu().
>
> The above snippet is where the UAF happens (you can refer to syzkaller's log),
> because __cfg80211_scan_done() is called and frees the pointer.
Similarly to Greg, I'm not very familiar with the code base but one
sure way to move things forward would be to point out a commit which
broke things and put it in a Fixes tag. Much easier to validate a fix
by looking at where things went wrong.
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
next prev parent reply other threads:[~2022-08-12 19:25 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-26 12:39 [PATCH v2] wifi: cfg80211: Fix UAF in ieee80211_scan_rx() Siddh Raman Pant via Linux-kernel-mentees
2022-08-12 9:51 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-12 12:15 ` Greg KH
2022-08-12 14:33 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-12 15:27 ` Greg KH
2022-08-12 16:27 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-12 19:25 ` Jakub Kicinski [this message]
2022-08-13 16:19 ` Siddh Raman Pant via Linux-kernel-mentees
2022-08-15 16:47 ` Jakub Kicinski
2022-08-15 19:58 ` Johannes Berg
2022-08-16 0:51 ` Jakub Kicinski
2022-08-16 8:52 ` Siddh Raman Pant via Linux-kernel-mentees
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220812122509.281f0536@kernel.org \
--to=kuba@kernel.org \
--cc=code@siddh.me \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=johannes@sipsolutions.net \
--cc=linux-kernel-mentees@lists.linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzbot+6cb476b7c69916a0caca@syzkaller.appspotmail.com \
--cc=syzbot+9250865a55539d384347@syzkaller.appspotmail.com \
--cc=syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).