[PATCH 4.4 005/101] mac80211: initialize fast-xmit info later

From	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups	linux.kernel
Subject	[PATCH 4.4 005/101] mac80211: initialize fast-xmit info later
Date	2017-01-10 16:20 +0100
Message-ID	<sY6no-2ZC-61@gated-at.bofh.it> (permalink)
References	<sY4OB-1Tf-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Berg <johannes.berg@intel.com>

commit 35f432a03e41d3bf08c51ede917f94e2288fbe8c upstream.

In ieee80211_xmit_fast(), 'info' is initialized to point to the skb
that's passed in, but that skb may later be replaced by a clone (if
it was shared), leading to an invalid pointer.

This can lead to use-after-free and also later crashes since the
real SKB's info->hw_queue doesn't get initialized properly.

Fix this by assigning info only later, when it's needed, after the
skb replacement (may have) happened.

Reported-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/tx.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2699,7 +2699,7 @@ static bool ieee80211_xmit_fast(struct i
 	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
 	int hw_headroom = sdata->local->hw.extra_tx_headroom;
 	struct ethhdr eth;
-	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+	struct ieee80211_tx_info *info;
 	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
 	struct ieee80211_tx_data tx;
 	ieee80211_tx_result r;
@@ -2761,6 +2761,7 @@ static bool ieee80211_xmit_fast(struct i
 	memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
 	memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
 
+	info = IEEE80211_SKB_CB(skb);
 	memset(info, 0, sizeof(*info));
 	info->band = fast_tx->band;
 	info->control.vif = &sdata->vif;

Thread

[PATCH 4.4 000/101] 4.4.42-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:20 +0100
  [PATCH 4.4 004/101] ARM: davinci: da850: dont add emac clock to lookup table twice Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:20 +0100
  [PATCH 4.4 059/101] mei: bus: fix mei_cldev_enable KDoc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:20 +0100
  [PATCH 4.4 026/101] usb: xhci: hold lock over xhci_abort_cmd_ring() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:20 +0100
  [PATCH 4.4 051/101] usb: musb: Fix trying to free already-free IRQ 4 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:20 +0100
  [PATCH 4.4 055/101] USB: serial: kl5kusb105: abort on open exception path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:20 +0100
  [PATCH 4.4 043/101] USB: serial: mos7720: fix NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:20 +0100
  [PATCH 4.4 020/101] xhci: workaround for hosts missing CAS bit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:20 +0100
  [PATCH 4.4 056/101] ARM: dts: r8a7794: Correct hsusb parent clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:20 +0100
  [PATCH 4.4 005/101] mac80211: initialize fast-xmit info later Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:20 +0100
  [PATCH 4.4 003/101] ALSA: usb-audio: Fix irq/process data synchronization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:20 +0100
  [PATCH 4.4 013/101] USB: gadgetfs: fix use-after-free bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:30 +0100
  [PATCH 4.4 014/101] USB: gadgetfs: fix checks of wTotalLength in config descriptors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:30 +0100
  [PATCH 4.4 019/101] usb: xhci: fix possible wild pointer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:30 +0100
  [PATCH 4.4 001/101] ALSA: hda - Fix up GPIO for ASUS ROG Ranger Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:30 +0100
  [PATCH 4.4 018/101] usb: dwc3: core: avoid Overflow events Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:30 +0100
  [PATCH 4.4 011/101] usb: gadgetfs: restrict upper bound on device configuration size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:30 +0100
  [PATCH 4.4 015/101] USB: fix problems with duplicate endpoint addresses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-10 16:30 +0100
  Re: [PATCH 4.4 000/101] 4.4.42-stable review Shuah Khan <shuah.kh@samsung.com> - 2017-01-10 18:40 +0100
  Re: [PATCH 4.4 000/101] 4.4.42-stable review Guenter Roeck <linux@roeck-us.net> - 2017-01-10 23:30 +0100

csiph-web