Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1620436

[PATCH 4.10 033/110] brcmfmac: use local iftype avoiding use-after-free of virtual interface

Show all headers | View raw

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arend Van Spriel <arend.vanspriel@broadcom.com>

commit d77facb88448cdeaaa3adba5b9704a48ac2ac8d6 upstream.

A use-after-free was found using KASAN. In brcmf_p2p_del_if() the virtual
interface is removed using call to brcmf_remove_interface(). After that
the virtual interface instance has been freed and should not be referenced.
Solve this by storing the nl80211 iftype in local variable, which is used
in a couple of places anyway.

Reported-by: Daniel J Blueman <daniel@quora.org>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -2238,14 +2238,16 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
 	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 	struct brcmf_p2p_info *p2p = &cfg->p2p;
 	struct brcmf_cfg80211_vif *vif;
+	enum nl80211_iftype iftype;
 	bool wait_for_disable = false;
 	int err;
 
 	brcmf_dbg(TRACE, "delete P2P vif\n");
 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 
+	iftype = vif->wdev.iftype;
 	brcmf_cfg80211_arm_vif_event(cfg, vif);
-	switch (vif->wdev.iftype) {
+	switch (iftype) {
 	case NL80211_IFTYPE_P2P_CLIENT:
 		if (test_bit(BRCMF_VIF_STATUS_DISCONNECTING, &vif->sme_state))
 			wait_for_disable = true;
@@ -2275,7 +2277,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
 					    BRCMF_P2P_DISABLE_TIMEOUT);
 
 	err = 0;
-	if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE) {
+	if (iftype != NL80211_IFTYPE_P2P_DEVICE) {
 		brcmf_vif_clear_mgmt_ies(vif);
 		err = brcmf_p2p_release_p2p_if(vif);
 	}
@@ -2291,7 +2293,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
 	brcmf_remove_interface(vif->ifp, true);
 
 	brcmf_cfg80211_arm_vif_event(cfg, NULL);
-	if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE)
+	if (iftype != NL80211_IFTYPE_P2P_DEVICE)
 		p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = NULL;
 
 	return err;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.10 000/110] 4.10.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 026/110] ACPI / scan: Prefer devices without _HID for _ADR matching Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 011/110] arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 039/110] metag/usercopy: Fix src fixup in from user rapf loops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 020/110] mm/page_alloc.c: fix print order in show_free_areas() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 001/110] drm/vmwgfx: Type-check lookups of fence objects Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 022/110] dax: fix radix tree insertion race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 028/110] jump label: fix passing kbuild_cflags when checking for asm goto support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 032/110] mac80211: unconditionally start new netdev queues with iTXQ support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 024/110] dm verity fec: fix bufio leaks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 031/110] ring-buffer: Fix return value check in test_ringbuffer() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 014/110] iio: core: Fix IIO_VAL_FRACTIONAL_LOG2 for negative values Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 033/110] brcmfmac: use local iftype avoiding use-after-free of virtual interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  Re: [PATCH 4.10 000/110] 4.10.10-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-10 22:40 +0200
    Re: [PATCH 4.10 000/110] 4.10.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-11 07:00 +0200
  Re: [PATCH 4.10 000/110] 4.10.10-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-11 05:20 +0200
    Re: [PATCH 4.10 000/110] 4.10.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-11 06:50 +0200
      Re: [PATCH 4.10 000/110] 4.10.10-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-11 07:10 +0200
  Re: [PATCH 4.10 000/110] 4.10.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-11 07:10 +0200

csiph-web