stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	"Matthias Kretschmer" <mathias.kretschmer@fit.fraunhofer.de>,
	"Linus Lüssing" <ll@simonwunderlich.de>,
	"Johannes Berg" <johannes.berg@intel.com>
Subject: [PATCH 5.17 34/39] mac80211: fix potential double free on mesh join
Date: Fri, 25 Mar 2022 16:14:49 +0100	[thread overview]
Message-ID: <20220325150421.220368778@linuxfoundation.org> (raw)
In-Reply-To: <20220325150420.245733653@linuxfoundation.org>

From: Linus Lüssing <ll@simonwunderlich.de>

commit 4a2d4496e15ea5bb5c8e83b94ca8ca7fb045e7d3 upstream.

While commit 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving
mesh") fixed a memory leak on mesh leave / teardown it introduced a
potential memory corruption caused by a double free when rejoining the
mesh:

  ieee80211_leave_mesh()
  -> kfree(sdata->u.mesh.ie);
  ...
  ieee80211_join_mesh()
  -> copy_mesh_setup()
     -> old_ie = ifmsh->ie;
     -> kfree(old_ie);

This double free / kernel panics can be reproduced by using wpa_supplicant
with an encrypted mesh (if set up without encryption via "iw" then
ifmsh->ie is always NULL, which avoids this issue). And then calling:

  $ iw dev mesh0 mesh leave
  $ iw dev mesh0 mesh join my-mesh

Note that typically these commands are not used / working when using
wpa_supplicant. And it seems that wpa_supplicant or wpa_cli are going
through a NETDEV_DOWN/NETDEV_UP cycle between a mesh leave and mesh join
where the NETDEV_UP resets the mesh.ie to NULL via a memcpy of
default_mesh_setup in cfg80211_netdev_notifier_call, which then avoids
the memory corruption, too.

The issue was first observed in an application which was not using
wpa_supplicant but "Senf" instead, which implements its own calls to
nl80211.

Fixing the issue by removing the kfree()'ing of the mesh IE in the mesh
join function and leaving it solely up to the mesh leave to free the
mesh IE.

Cc: stable@vger.kernel.org
Fixes: 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving mesh")
Reported-by: Matthias Kretschmer <mathias.kretschmer@fit.fraunhofer.de>
Signed-off-by: Linus Lüssing <ll@simonwunderlich.de>
Tested-by: Mathias Kretschmer <mathias.kretschmer@fit.fraunhofer.de>
Link: https://lore.kernel.org/r/20220310183513.28589-1-linus.luessing@c0d3.blue
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/cfg.c |    3 ---
 1 file changed, 3 deletions(-)

--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2148,14 +2148,12 @@ static int copy_mesh_setup(struct ieee80
 		const struct mesh_setup *setup)
 {
 	u8 *new_ie;
-	const u8 *old_ie;
 	struct ieee80211_sub_if_data *sdata = container_of(ifmsh,
 					struct ieee80211_sub_if_data, u.mesh);
 	int i;
 
 	/* allocate information elements */
 	new_ie = NULL;
-	old_ie = ifmsh->ie;
 
 	if (setup->ie_len) {
 		new_ie = kmemdup(setup->ie, setup->ie_len,
@@ -2165,7 +2163,6 @@ static int copy_mesh_setup(struct ieee80
 	}
 	ifmsh->ie_len = setup->ie_len;
 	ifmsh->ie = new_ie;
-	kfree(old_ie);
 
 	/* now copy the rest of the setup parameters */
 	ifmsh->mesh_id_len = setup->mesh_id_len;



  parent reply	other threads:[~2022-03-25 15:27 UTC|newest]

Thread overview: 51+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-03-25 15:14 [PATCH 5.17 00/39] 5.17.1-rc1 review Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 01/39] tpm: Fix error handling in async work Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 02/39] Bluetooth: btusb: Add another Realtek 8761BU Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 03/39] llc: fix netdevice reference leaks in llc_ui_bind() Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 04/39] ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 05/39] ALSA: oss: Fix PCM OSS buffer allocation overflow Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 06/39] ALSA: usb-audio: add mapping for new Corsair Virtuoso SE Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 07/39] ALSA: hda/realtek: Add quirk for Clevo NP70PNJ Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 08/39] ALSA: hda/realtek: Add quirk for Clevo NP50PNJ Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 09/39] ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 10/39] ALSA: hda/realtek: Add quirk for ASUS GA402 Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 11/39] ALSA: pcm: Fix races among concurrent hw_params and hw_free calls Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 12/39] ALSA: pcm: Fix races among concurrent read/write and buffer changes Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 13/39] ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 14/39] ALSA: pcm: Fix races among concurrent prealloc proc writes Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 15/39] ALSA: pcm: Add stream lock during PCM reset ioctl operations Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 16/39] ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 17/39] ALSA: cmipci: Restore aux vol on suspend/resume Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 18/39] ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 19/39] drivers: net: xgene: Fix regression in CRC stripping Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 20/39] netfilter: nf_tables: initialize registers in nft_do_chain() Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 21/39] netfilter: nf_tables: validate registers coming from userspace Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 22/39] ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 23/39] ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 24/39] ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 25/39] crypto: qat - disable registration of algorithms Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 26/39] Bluetooth: btusb: Add one more Bluetooth part for the Realtek RTL8852AE Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 27/39] Bluetooth: hci_sync: Add a new quirk to skip HCI_FLT_CLEAR_ALL Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 28/39] Bluetooth: btusb: Use quirk to skip HCI_FLT_CLEAR_ALL on fake CSR controllers Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 29/39] Revert "ath: add support for special 0x0 regulatory domain" Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 30/39] drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 31/39] jbd2: fix use-after-free of transaction_t race Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 32/39] rcu: Dont deboost before reporting expedited quiescent state Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 33/39] uaccess: fix integer overflow on access_ok() Greg Kroah-Hartman
2022-03-25 15:14 ` Greg Kroah-Hartman [this message]
2022-03-25 15:14 ` [PATCH 5.17 35/39] tpm: fix reference counting for struct tpm_chip Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 36/39] tpm: use try_get_ops() in tpm-space.c Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 37/39] wcn36xx: Differentiate wcn3660 from wcn3620 Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 38/39] m68k: fix access_ok for coldfire Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 39/39] nds32: fix access_ok() checks in get/put_user Greg Kroah-Hartman
2022-03-25 23:22 ` [PATCH 5.17 00/39] 5.17.1-rc1 review Shuah Khan
2022-03-26  1:22 ` Fox Chen
2022-03-26  2:53 ` Rudi Heitbaum
2022-03-26  3:07 ` Florian Fainelli
2022-03-26  4:54 ` Naresh Kamboju
2022-03-26  9:55   ` Greg Kroah-Hartman
2022-03-26 12:26     ` Naresh Kamboju
2022-03-26 12:19 ` Bagas Sanjaya
2022-03-27  0:13 ` Ron Economos
2022-03-27  0:52 ` Guenter Roeck
2022-03-27  1:37 ` Justin Forbes

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220325150421.220368778@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=johannes.berg@intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=ll@simonwunderlich.de \
    --cc=mathias.kretschmer@fit.fraunhofer.de \
    --cc=stable@vger.kernel.org \
    --subject='Re: [PATCH 5.17 34/39] mac80211: fix potential double free on mesh join' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).