korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-15 00:04:15 +08:00
Code Issues Packages Projects Releases Wiki Activity
9ad48cbf8b
linux/net/mac80211
History
Siddh Raman Pant 9ad48cbf8b wifi: mac80211: Fix UAF in ieee80211_scan_rx() 
[ Upstream commit 60deb9f10e ]

ieee80211_scan_rx() tries to access scan_req->flags after a
null check, but a UAF is observed when the scan is completed
and __ieee80211_scan_completed() executes, which then calls
cfg80211_scan_done() leading to the freeing of scan_req.

Since scan_req is rcu_dereference()'d, prevent the racing in
__ieee80211_scan_completed() by ensuring that from mac80211's
POV it is no longer accessed from an RCU read critical section
before we call cfg80211_scan_done().

Cc: stable@vger.kernel.org
Link: https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d
Reported-by: syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com
Suggested-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Siddh Raman Pant <code@siddh.me>
Link: https://lore.kernel.org/r/20220819200340.34826-1-code@siddh.me
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-09-28 11:04:01 +02:00
..
aead_api.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aead_api.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aes_ccm.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aes_cmac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aes_cmac.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aes_gcm.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aes_gmac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aes_gmac.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
agg-rx.c mac80211: fix lookup when adding AddBA extension element 2021-12-22 09:29:37 +01:00
agg-tx.c mac80211: refuse aggregations sessions before authorized 2022-03-19 13:40:16 +01:00
cfg.c mac80211: fix potential double free on mesh join 2022-03-28 08:46:48 +02:00
chan.c wifi: mac80211: fix use-after-free in chanctx code 2022-06-14 18:11:44 +02:00
debug.h
debugfs_key.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-06-22 08:59:24 -04:00
debugfs_key.h
debugfs_netdev.c mac80211: fix txq null pointer dereference 2019-10-01 17:56:19 +02:00
debugfs_netdev.h
debugfs_sta.c mac80211: drop data frames without key on encrypted links 2020-04-01 11:02:01 +02:00
debugfs_sta.h
debugfs.c mac80211: AMPDU handling for rekeys with Extended Key ID 2019-07-26 13:29:10 +02:00
debugfs.h
driver-ops.c mac80211: fix station rate table updates on assoc 2021-02-10 09:25:29 +01:00
driver-ops.h mac80211: mark TX-during-stop for TX in in_reconfig 2021-12-22 09:29:34 +01:00
ethtool.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 432 2019-06-05 17:37:16 +02:00
fils_aead.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
fils_aead.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
he.c mac80211: fix possible NULL pointerderef in obss pd code 2019-08-21 10:58:32 +02:00
ht.c mac80211: add support for the ADDBA extension element 2019-07-29 16:40:22 +02:00
ibss.c wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected 2022-09-15 12:04:53 +02:00
ieee80211_i.h mac80211: upgrade passive scan to active scan on DFS channels after beacon rx 2022-06-14 18:11:48 +02:00
iface.c mac80211: Fix monitor MTU limit so that A-MSDUs get through 2021-09-22 12:26:32 +02:00
Kconfig Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
key.c mac80211: prevent mixed key and fragment cache attacks 2021-06-03 08:59:01 +02:00
key.h mac80211: prevent mixed key and fragment cache attacks 2021-06-03 08:59:01 +02:00
led.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
led.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
main.c mac80211: bail out if cipher schemes are invalid 2021-05-14 09:44:28 +02:00
Makefile mac80211: minstrel: merge with minstrel_ht, always enable VHT support 2018-10-11 16:01:01 +02:00
mesh_hwmp.c mac80211: fix potential overflow when multiplying to u32 integers 2021-03-04 10:26:17 +01:00
mesh_pathtbl.c mac80211: check return value of rhashtable_init 2021-10-17 10:42:34 +02:00
mesh_plink.c mac80211: implement HE support for mesh 2019-07-26 16:14:12 +02:00
mesh_ps.c mac80211: mesh: fix potentially unaligned access 2021-10-06 15:42:32 +02:00
mesh_sync.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
mesh.c mac80211: fix channel switch trigger from unknown mesh peer 2020-05-02 08:48:58 +02:00
mesh.h mac80211: implement HE support for mesh 2019-07-26 16:14:12 +02:00
michael.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
michael.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
mlme.c mac80211: Reset MBSSID parameters upon connection 2022-05-18 09:47:24 +02:00
ocb.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
offchannel.c mac80211: pass the vif to cancel_remain_on_channel 2019-07-26 13:08:28 +02:00
pm.c
rate.c mac80211: fix station rate table updates on assoc 2021-02-10 09:25:29 +01:00
rate.h mac80211: populate debugfs only after cfg80211 init 2020-04-29 16:33:18 +02:00
rc80211_minstrel_debugfs.c mac80211: rc80211_minstrel: remove variance / stddev calculation 2018-10-11 16:01:05 +02:00
rc80211_minstrel_ht_debugfs.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rc80211_minstrel_ht.c mac80211: populate debugfs only after cfg80211 init 2020-04-29 16:33:18 +02:00
rc80211_minstrel_ht.h mac80211: minstrel_ht: improve rate probing for devices with static fallback 2019-08-21 11:10:13 +02:00
rc80211_minstrel.c mac80211: minstrel: fix tx status processing corner case 2020-11-24 13:29:23 +01:00
rc80211_minstrel.h mac80211: minstrel: remove deferred sampling code 2020-11-24 13:29:23 +01:00
rx.c mac80211: fix rx reordering with non explicit / psmp ack policy 2022-05-25 09:14:37 +02:00
scan.c wifi: mac80211: Fix UAF in ieee80211_scan_rx() 2022-09-28 11:04:01 +02:00
spectmgmt.c mac80211: 160MHz with extended NSS BW in CSA 2021-02-13 13:52:55 +01:00
sta_info.c mac80211: remove iwlwifi specific workaround NDPs of null_response 2021-07-14 16:53:32 +02:00
sta_info.h mac80211: fix regression in SSN handling of addba tx 2021-12-22 09:29:40 +01:00
status.c mac80211: add ieee80211_is_any_nullfunc() 2020-05-10 10:31:32 +02:00
tdls.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-06-17 15:55:34 -07:00
tkip.c mac80211: Fix TKIP replay protection immediately after key setup 2020-02-05 21:22:46 +00:00
tkip.h Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
trace_msg.h mac80211: Increase MAX_MSG_LEN 2019-03-29 11:20:36 +01:00
trace.c
trace.h mac80211: pass the vif to cancel_remain_on_channel 2019-07-26 13:08:28 +02:00
tx.c mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap 2021-10-06 15:42:32 +02:00
util.c mac80211: validate extended element ID is present 2021-12-22 09:29:39 +01:00
vht.c mac80211: don't set set TDLS STA bandwidth wider than possible 2020-12-30 11:51:25 +01:00
wep.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
wep.h Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
wme.c wifi: mac80211: fix queue selection for mesh/OCB interfaces 2022-07-21 20:59:17 +02:00
wme.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wpa.c mac80211: fix use-after-free in CCMP/GCMP RX 2021-10-06 15:42:31 +02:00
wpa.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00