From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>, stable@vger.kernel.org, "Matthias Kretschmer" <mathias.kretschmer@fit.fraunhofer.de>, "Linus Lüssing" <ll@simonwunderlich.de>, "Johannes Berg" <johannes.berg@intel.com> Subject: [PATCH 5.17 34/39] mac80211: fix potential double free on mesh join Date: Fri, 25 Mar 2022 16:14:49 +0100 [thread overview] Message-ID: <20220325150421.220368778@linuxfoundation.org> (raw) In-Reply-To: <20220325150420.245733653@linuxfoundation.org> From: Linus Lüssing <ll@simonwunderlich.de> commit 4a2d4496e15ea5bb5c8e83b94ca8ca7fb045e7d3 upstream. While commit 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving mesh") fixed a memory leak on mesh leave / teardown it introduced a potential memory corruption caused by a double free when rejoining the mesh: ieee80211_leave_mesh() -> kfree(sdata->u.mesh.ie); ... ieee80211_join_mesh() -> copy_mesh_setup() -> old_ie = ifmsh->ie; -> kfree(old_ie); This double free / kernel panics can be reproduced by using wpa_supplicant with an encrypted mesh (if set up without encryption via "iw" then ifmsh->ie is always NULL, which avoids this issue). And then calling: $ iw dev mesh0 mesh leave $ iw dev mesh0 mesh join my-mesh Note that typically these commands are not used / working when using wpa_supplicant. And it seems that wpa_supplicant or wpa_cli are going through a NETDEV_DOWN/NETDEV_UP cycle between a mesh leave and mesh join where the NETDEV_UP resets the mesh.ie to NULL via a memcpy of default_mesh_setup in cfg80211_netdev_notifier_call, which then avoids the memory corruption, too. The issue was first observed in an application which was not using wpa_supplicant but "Senf" instead, which implements its own calls to nl80211. Fixing the issue by removing the kfree()'ing of the mesh IE in the mesh join function and leaving it solely up to the mesh leave to free the mesh IE. Cc: stable@vger.kernel.org Fixes: 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving mesh") Reported-by: Matthias Kretschmer <mathias.kretschmer@fit.fraunhofer.de> Signed-off-by: Linus Lüssing <ll@simonwunderlich.de> Tested-by: Mathias Kretschmer <mathias.kretschmer@fit.fraunhofer.de> Link: https://lore.kernel.org/r/20220310183513.28589-1-linus.luessing@c0d3.blue Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/mac80211/cfg.c | 3 --- 1 file changed, 3 deletions(-) --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -2148,14 +2148,12 @@ static int copy_mesh_setup(struct ieee80 const struct mesh_setup *setup) { u8 *new_ie; - const u8 *old_ie; struct ieee80211_sub_if_data *sdata = container_of(ifmsh, struct ieee80211_sub_if_data, u.mesh); int i; /* allocate information elements */ new_ie = NULL; - old_ie = ifmsh->ie; if (setup->ie_len) { new_ie = kmemdup(setup->ie, setup->ie_len, @@ -2165,7 +2163,6 @@ static int copy_mesh_setup(struct ieee80 } ifmsh->ie_len = setup->ie_len; ifmsh->ie = new_ie; - kfree(old_ie); /* now copy the rest of the setup parameters */ ifmsh->mesh_id_len = setup->mesh_id_len;
next prev parent reply other threads:[~2022-03-25 15:27 UTC|newest] Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-03-25 15:14 [PATCH 5.17 00/39] 5.17.1-rc1 review Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 01/39] tpm: Fix error handling in async work Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 02/39] Bluetooth: btusb: Add another Realtek 8761BU Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 03/39] llc: fix netdevice reference leaks in llc_ui_bind() Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 04/39] ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 05/39] ALSA: oss: Fix PCM OSS buffer allocation overflow Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 06/39] ALSA: usb-audio: add mapping for new Corsair Virtuoso SE Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 07/39] ALSA: hda/realtek: Add quirk for Clevo NP70PNJ Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 08/39] ALSA: hda/realtek: Add quirk for Clevo NP50PNJ Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 09/39] ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 10/39] ALSA: hda/realtek: Add quirk for ASUS GA402 Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 11/39] ALSA: pcm: Fix races among concurrent hw_params and hw_free calls Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 12/39] ALSA: pcm: Fix races among concurrent read/write and buffer changes Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 13/39] ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 14/39] ALSA: pcm: Fix races among concurrent prealloc proc writes Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 15/39] ALSA: pcm: Add stream lock during PCM reset ioctl operations Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 16/39] ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 17/39] ALSA: cmipci: Restore aux vol on suspend/resume Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 18/39] ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 19/39] drivers: net: xgene: Fix regression in CRC stripping Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 20/39] netfilter: nf_tables: initialize registers in nft_do_chain() Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 21/39] netfilter: nf_tables: validate registers coming from userspace Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 22/39] ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 23/39] ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 24/39] ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 25/39] crypto: qat - disable registration of algorithms Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 26/39] Bluetooth: btusb: Add one more Bluetooth part for the Realtek RTL8852AE Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 27/39] Bluetooth: hci_sync: Add a new quirk to skip HCI_FLT_CLEAR_ALL Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 28/39] Bluetooth: btusb: Use quirk to skip HCI_FLT_CLEAR_ALL on fake CSR controllers Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 29/39] Revert "ath: add support for special 0x0 regulatory domain" Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 30/39] drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 31/39] jbd2: fix use-after-free of transaction_t race Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 32/39] rcu: Dont deboost before reporting expedited quiescent state Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 33/39] uaccess: fix integer overflow on access_ok() Greg Kroah-Hartman 2022-03-25 15:14 ` Greg Kroah-Hartman [this message] 2022-03-25 15:14 ` [PATCH 5.17 35/39] tpm: fix reference counting for struct tpm_chip Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 36/39] tpm: use try_get_ops() in tpm-space.c Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 37/39] wcn36xx: Differentiate wcn3660 from wcn3620 Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 38/39] m68k: fix access_ok for coldfire Greg Kroah-Hartman 2022-03-25 15:14 ` [PATCH 5.17 39/39] nds32: fix access_ok() checks in get/put_user Greg Kroah-Hartman 2022-03-25 23:22 ` [PATCH 5.17 00/39] 5.17.1-rc1 review Shuah Khan 2022-03-26 1:22 ` Fox Chen 2022-03-26 2:53 ` Rudi Heitbaum 2022-03-26 3:07 ` Florian Fainelli 2022-03-26 4:54 ` Naresh Kamboju 2022-03-26 9:55 ` Greg Kroah-Hartman 2022-03-26 12:26 ` Naresh Kamboju 2022-03-26 12:19 ` Bagas Sanjaya 2022-03-27 0:13 ` Ron Economos 2022-03-27 0:52 ` Guenter Roeck 2022-03-27 1:37 ` Justin Forbes
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220325150421.220368778@linuxfoundation.org \ --to=gregkh@linuxfoundation.org \ --cc=johannes.berg@intel.com \ --cc=linux-kernel@vger.kernel.org \ --cc=ll@simonwunderlich.de \ --cc=mathias.kretschmer@fit.fraunhofer.de \ --cc=stable@vger.kernel.org \ --subject='Re: [PATCH 5.17 34/39] mac80211: fix potential double free on mesh join' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).