From patchwork Fri May 22 08:57:22 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Kazior X-Patchwork-Id: 6462101 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id CE99DC0020 for ; Fri, 22 May 2015 08:57:49 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id D8B6B202FE for ; Fri, 22 May 2015 08:57:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E09302017D for ; Fri, 22 May 2015 08:57:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756750AbbEVI5q (ORCPT ); Fri, 22 May 2015 04:57:46 -0400 Received: from mail-wi0-f176.google.com ([209.85.212.176]:36173 "EHLO mail-wi0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756462AbbEVI5n (ORCPT ); Fri, 22 May 2015 04:57:43 -0400 Received: by wizk4 with SMTP id k4so40383492wiz.1 for ; Fri, 22 May 2015 01:57:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tieto.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=TXiWGGns5WAPdtksurBEMLFr0vj3HPwaY/c9h0+usDo=; b=rJQLW1HcfUkX7WSiy4jqtF/F9JB5uGZ8RrXTjRuN85I3RSuSwdj4S590Na/SvVjy5A YiPTVEmNlLTlX14110W4o7wAsGhHwcDWJmxNGmJPQj7B9G5voDVo780iT/7G+LuGnpiB TrucZpoJcauzKfppanJzesGT8l2es/uY/yTgY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=TXiWGGns5WAPdtksurBEMLFr0vj3HPwaY/c9h0+usDo=; b=O1pJIB0ryHKsAmM1cudfMJb/60lmeEKbUCluU9n/HjmD0xYmtCxjFS8uG2lT8A4pjc Y8zmQNLp7Zw3qNMEuOnS7tsPbb9rZ9B8m4j2LDhQcevK9tCXemtL+7J9fGL8zK70TxzU 4F1RHeyh3AG9/SQzIiaNCe/t16KrAffZsurzsmNwgZURUyjlhGVy5vwyq14tjXSn/Yyg ywtzIitJfo+bZ8ly/ILfNebnNoM+xyhnG0RJKQXy0a/Ig9ATeKHgmxdr2Dnt8vcESg+w h7HOf4NNttBYMwr1P0flFc6hhpYkZGJmgWYUr9id1iFmq6rDGwiKTxZu5tsnLGB+KGOl 8+DA== X-Gm-Message-State: ALoCoQm/tAwfWxiwCpyvBLlHrD8i010b9woQXi8HSIAi26yNGccnz06ovnH+oiZD5EvJr3CjgG3IEBbasYhYWAuTvCjpT+4JywS9xt0zoclBwkXCvHpjLdSemkt8ErnvxOywDUGezsMhbZKVA4hJLCiPACuWqfEMQMXI358oXnQnxCfSr2kAwEFJ4UNLtvitKIsjLe+0oHKt X-Received: by 10.180.231.41 with SMTP id td9mr5443124wic.69.1432285062187; Fri, 22 May 2015 01:57:42 -0700 (PDT) Received: from localhost.localdomain ([91.198.246.8]) by mx.google.com with ESMTPSA id js3sm2163782wjc.5.2015.05.22.01.57.41 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 22 May 2015 01:57:41 -0700 (PDT) From: Michal Kazior To: linux-wireless@vger.kernel.org Cc: johannes@sipsolutions.net, Michal Kazior Subject: [PATCH v2 1/2] cfg80211: ignore netif running state when changing iftype Date: Fri, 22 May 2015 10:57:22 +0200 Message-Id: <1432285043-8878-1-git-send-email-michal.kazior@tieto.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1432039021-29666-1-git-send-email-michal.kazior@tieto.com> References: <1432039021-29666-1-git-send-email-michal.kazior@tieto.com> X-DomainID: tieto.com Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID,T_RP_MATCHES_RCVD,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP It was possible for mac80211 to be coerced into an unexpected flow causing sdata union to become corrupted. Station pointer was put into sdata->u.vlan.sta memory location while it was really master AP's sdata->u.ap.next_beacon. This led to station entry being later freed as next_beacon before __sta_info_flush() in ieee80211_stop_ap() and a subsequent invalid pointer dereference crash. The problem was that ieee80211_ptr->use_4addr wasn't cleared on interface type changes. This could be reproduced with the following steps: # host A and host B have just booted; no # wpa_s/hostapd running; all vifs are down host A> iw wlan0 set type station host A> iw wlan0 set 4addr on host A> printf 'interface=wlan0\nssid=4addrcrash\nchannel=1\nwds_sta=1' > /tmp/hconf host A> hostapd -B /tmp/conf host B> iw wlan0 set 4addr on host B> ifconfig wlan0 up host B> iw wlan0 connect -w hostAssid host A> pkill hostapd # host A crashed: [ 127.928192] BUG: unable to handle kernel NULL pointer dereference at 00000000000006c8 [ 127.929014] IP: [] __sta_info_flush+0xac/0x158 ... [ 127.934578] [] ieee80211_stop_ap+0x139/0x26c [ 127.934578] [] ? dump_trace+0x279/0x28a [ 127.934578] [] __cfg80211_stop_ap+0x84/0x191 [ 127.934578] [] cfg80211_stop_ap+0x3f/0x58 [ 127.934578] [] nl80211_stop_ap+0x1b/0x1d [ 127.934578] [] genl_family_rcv_msg+0x259/0x2b5 Note: This isn't a revert of f8cdddb8d61d ("cfg80211: check iface combinations only when iface is running") as far as functionality is considered because b6a550156bc ("cfg80211/mac80211: move more combination checks to mac80211") moved the logic somewhere else already. Fixes: f8cdddb8d61d ("cfg80211: check iface combinations only when iface is running") Signed-off-by: Michal Kazior --- Notes: v2: * improve commit log [Johannes] net/wireless/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/wireless/util.c b/net/wireless/util.c index 70051ab52f4f..7e4e3fffe7ce 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -944,7 +944,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev, ntype == NL80211_IFTYPE_P2P_CLIENT)) return -EBUSY; - if (ntype != otype && netif_running(dev)) { + if (ntype != otype) { dev->ieee80211_ptr->use_4addr = false; dev->ieee80211_ptr->mesh_id_up_len = 0; wdev_lock(dev->ieee80211_ptr);