package/kernel/mac80211/patches/318-v4.11-0007-brcmfmac-use-local-iftype-avoiding-use-after-free-of.patch

   1 From d77facb88448cdeaaa3adba5b9704a48ac2ac8d6 Mon Sep 17 00:00:00 2001
   2 From: Arend Van Spriel <arend.vanspriel@broadcom.com>
   3 Date: Tue, 28 Mar 2017 09:11:30 +0100
   4 Subject: [PATCH] brcmfmac: use local iftype avoiding use-after-free of virtual
   5  interface
   6
   7 A use-after-free was found using KASAN. In brcmf_p2p_del_if() the virtual
   8 interface is removed using call to brcmf_remove_interface(). After that
   9 the virtual interface instance has been freed and should not be referenced.
  10 Solve this by storing the nl80211 iftype in local variable, which is used
  11 in a couple of places anyway.
  12
  13 Cc: stable@vger.kernel.org # 4.10.x, 4.9.x
  14 Reported-by: Daniel J Blueman <daniel@quora.org>
  15 Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
  16 Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
  17 Reviewed-by: Franky Lin <franky.lin@broadcom.com>
  18 Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
  19 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  20 ---
  21  drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 8 +++++---
  22  1 file changed, 5 insertions(+), 3 deletions(-)
  23
  24 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
  25 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
  26 @@ -2240,14 +2240,16 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
  27         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
  28         struct brcmf_p2p_info *p2p = &cfg->p2p;
  29         struct brcmf_cfg80211_vif *vif;
  30 +       enum nl80211_iftype iftype;
  31         bool wait_for_disable = false;
  32         int err;
  33
  34         brcmf_dbg(TRACE, "delete P2P vif\n");
  35         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
  36
  37 +       iftype = vif->wdev.iftype;
  38         brcmf_cfg80211_arm_vif_event(cfg, vif);
  39 -       switch (vif->wdev.iftype) {
  40 +       switch (iftype) {
  41         case NL80211_IFTYPE_P2P_CLIENT:
  42                 if (test_bit(BRCMF_VIF_STATUS_DISCONNECTING, &vif->sme_state))
  43                         wait_for_disable = true;
  44 @@ -2277,7 +2279,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
  45                                             BRCMF_P2P_DISABLE_TIMEOUT);
  46
  47         err = 0;
  48 -       if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE) {
  49 +       if (iftype != NL80211_IFTYPE_P2P_DEVICE) {
  50                 brcmf_vif_clear_mgmt_ies(vif);
  51                 err = brcmf_p2p_release_p2p_if(vif);
  52         }
  53 @@ -2293,7 +2295,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
  54         brcmf_remove_interface(vif->ifp, true);
  55
  56         brcmf_cfg80211_arm_vif_event(cfg, NULL);
  57 -       if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE)
  58 +       if (iftype != NL80211_IFTYPE_P2P_DEVICE)
  59                 p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = NULL;
  60
  61         return err;