From patchwork Fri May 22 08:57:23 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Kazior X-Patchwork-Id: 6462111 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 7B8149F1C1 for ; Fri, 22 May 2015 08:57:52 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 961E5202FE for ; Fri, 22 May 2015 08:57:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9929F2017D for ; Fri, 22 May 2015 08:57:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756462AbbEVI5s (ORCPT ); Fri, 22 May 2015 04:57:48 -0400 Received: from mail-wi0-f169.google.com ([209.85.212.169]:38391 "EHLO mail-wi0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756387AbbEVI5o (ORCPT ); Fri, 22 May 2015 04:57:44 -0400 Received: by wichy4 with SMTP id hy4so40040818wic.1 for ; Fri, 22 May 2015 01:57:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tieto.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=kHtdKyZWpCrEZXQCT5bRp8mu1dLddJ2aMxT1uxdsyAU=; b=shKzRbJRMI8QT434xnrj5vEtFmHjmfN21+lMbPYN2sODZO8a6eO7ZHx4j0zpYix+Z7 BKEuk6gYfFtXYCjzpf9jbBfMgrYiV/1n+f3bkT2/OHeJAJ9if5JPnmcD+8xsL7iva4ML ggxEGWjSCw9lk+mWJD5hbkNOmnqjjI5wquVBM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=kHtdKyZWpCrEZXQCT5bRp8mu1dLddJ2aMxT1uxdsyAU=; b=fALfLrn2XHgzMh7CJoEZO1PV7gato0v7oBW3CSPGzfWP2wlRPHialCrfjA0FCrJtEr 3ewnVb5+V1AoP6aAxBcGHAx+hD/35Cf5Si9M7p9CZlM72+vcg/gI0weOYovDmxqYjiaC /gkjpJ/91F5L1rygxP1drJoObBq8CTSGnmWDI7TeLjUegBS/Xd62az8FLMVnvipnGCjY upfltT/ivjCAnwvte2rnh+JT14n0njO6xo+T70uBvRM27DqkBG62DD1VpMjgM7HSj0LC Qkqy5Lt7tBxEt1YpyhFKvXEE0eWT5c6EnaUirkrENpLgPs9vPM/uIS9MQh5Phqaoh3Ow QltA== X-Gm-Message-State: ALoCoQnomoUk4349/s+IO6yKerOZjjP8o93WCTyvjZQMMfwlzAUmbX7BM80GbqMCy7hEsWOHXSqyZMinnJLGakGIZM/44jdb5hl6jbSajLP3S3DK+IWNEbsq/Bhoi9Vc1EMJV6nCzc5Ybhh9Yr4pSbHGim+ihUzfdLl4gu63i6yc2r7cXez4OgZwQUp6yEZHjUngxDln8cJb X-Received: by 10.194.133.133 with SMTP id pc5mr12705765wjb.31.1432285063377; Fri, 22 May 2015 01:57:43 -0700 (PDT) Received: from localhost.localdomain ([91.198.246.8]) by mx.google.com with ESMTPSA id js3sm2163782wjc.5.2015.05.22.01.57.42 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 22 May 2015 01:57:42 -0700 (PDT) From: Michal Kazior To: linux-wireless@vger.kernel.org Cc: johannes@sipsolutions.net, Michal Kazior Subject: [PATCH v2 2/2] mac80211: guard against invalid ptr deref Date: Fri, 22 May 2015 10:57:23 +0200 Message-Id: <1432285043-8878-2-git-send-email-michal.kazior@tieto.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1432285043-8878-1-git-send-email-michal.kazior@tieto.com> References: <1432039021-29666-1-git-send-email-michal.kazior@tieto.com> <1432285043-8878-1-git-send-email-michal.kazior@tieto.com> X-DomainID: tieto.com Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID,T_RP_MATCHES_RCVD,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP It was possible for mac80211 to be coerced into an unexpected flow causing sdata union to become corrupted. Station pointer was put into sdata->u.vlan.sta memory location while it was really master AP's sdata->u.ap.next_beacon. This led to station entry being later freed as next_beacon before __sta_info_flush() in ieee80211_stop_ap() and a subsequent invalid pointer dereference crash. The problem was that ieee80211_ptr->use_4addr wasn't cleared on interface type changes. This could be reproduced with the following steps: # host A and host B have just booted; no # wpa_s/hostapd running; all vifs are down host A> iw wlan0 set type station host A> iw wlan0 set 4addr on host A> printf 'interface=wlan0\nssid=4addrcrash\nchannel=1\nwds_sta=1' > /tmp/hconf host A> hostapd -B /tmp/conf host B> iw wlan0 set 4addr on host B> ifconfig wlan0 up host B> iw wlan0 connect -w hostAssid host A> pkill hostapd # host A crashed: [ 127.928192] BUG: unable to handle kernel NULL pointer dereference at 00000000000006c8 [ 127.929014] IP: [] __sta_info_flush+0xac/0x158 ... [ 127.934578] [] ieee80211_stop_ap+0x139/0x26c [ 127.934578] [] ? dump_trace+0x279/0x28a [ 127.934578] [] __cfg80211_stop_ap+0x84/0x191 [ 127.934578] [] cfg80211_stop_ap+0x3f/0x58 [ 127.934578] [] nl80211_stop_ap+0x1b/0x1d [ 127.934578] [] genl_family_rcv_msg+0x259/0x2b5 Even though this can and should be fixed in cfg80211 it still makes sense to add a sanity check to mac80211 to prevent future problems. Signed-off-by: Michal Kazior --- Notes: v2: * improve commit log [Johannes] net/mac80211/cfg.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index bb9f83640b46..d1f8d615701c 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -1395,6 +1395,12 @@ static int ieee80211_change_station(struct wiphy *wiphy, vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan); if (params->vlan->ieee80211_ptr->use_4addr) { + if (vlansdata->vif.type != NL80211_IFTYPE_AP_VLAN) { + WARN_ON(1); + err = -EINVAL; + goto out_err; + } + if (vlansdata->u.vlan.sta) { err = -EBUSY; goto out_err;