From f8c364b7204259b379c96f3e04d65ceed0a8fbe7 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Rafa=C5=82=20Mi=C5=82ecki?= Date: Thu, 16 Aug 2018 09:48:51 +0200 Subject: [PATCH] mac80211: brcmfmac: backport use-after-free fix from 4.11 MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Signed-off-by: Rafał Miłecki --- package/kernel/mac80211/Makefile | 2 +- ...al-iftype-avoiding-use-after-free-of.patch | 61 +++++++++++++++++++ 2 files changed, 62 insertions(+), 1 deletion(-) create mode 100644 package/kernel/mac80211/patches/318-v4.11-0007-brcmfmac-use-local-iftype-avoiding-use-after-free-of.patch diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile index 0a4cbc8ab4..697401d316 100644 --- a/package/kernel/mac80211/Makefile +++ b/package/kernel/mac80211/Makefile @@ -11,7 +11,7 @@ include $(INCLUDE_DIR)/kernel.mk PKG_NAME:=mac80211 PKG_VERSION:=2017-01-31 -PKG_RELEASE:=5 +PKG_RELEASE:=6 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources PKG_BACKPORT_VERSION:= PKG_HASH:=75e6d39e34cf156212a2509172a4a62b673b69eb4a1d9aaa565f7fa719fa2317 diff --git a/package/kernel/mac80211/patches/318-v4.11-0007-brcmfmac-use-local-iftype-avoiding-use-after-free-of.patch b/package/kernel/mac80211/patches/318-v4.11-0007-brcmfmac-use-local-iftype-avoiding-use-after-free-of.patch new file mode 100644 index 0000000000..53dc8fe8fc --- /dev/null +++ b/package/kernel/mac80211/patches/318-v4.11-0007-brcmfmac-use-local-iftype-avoiding-use-after-free-of.patch @@ -0,0 +1,61 @@ +From d77facb88448cdeaaa3adba5b9704a48ac2ac8d6 Mon Sep 17 00:00:00 2001 +From: Arend Van Spriel +Date: Tue, 28 Mar 2017 09:11:30 +0100 +Subject: [PATCH] brcmfmac: use local iftype avoiding use-after-free of virtual + interface + +A use-after-free was found using KASAN. In brcmf_p2p_del_if() the virtual +interface is removed using call to brcmf_remove_interface(). After that +the virtual interface instance has been freed and should not be referenced. +Solve this by storing the nl80211 iftype in local variable, which is used +in a couple of places anyway. + +Cc: stable@vger.kernel.org # 4.10.x, 4.9.x +Reported-by: Daniel J Blueman +Reviewed-by: Hante Meuleman +Reviewed-by: Pieter-Paul Giesberts +Reviewed-by: Franky Lin +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +@@ -2240,14 +2240,16 @@ int brcmf_p2p_del_vif(struct wiphy *wiph + struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy); + struct brcmf_p2p_info *p2p = &cfg->p2p; + struct brcmf_cfg80211_vif *vif; ++ enum nl80211_iftype iftype; + bool wait_for_disable = false; + int err; + + brcmf_dbg(TRACE, "delete P2P vif\n"); + vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev); + ++ iftype = vif->wdev.iftype; + brcmf_cfg80211_arm_vif_event(cfg, vif); +- switch (vif->wdev.iftype) { ++ switch (iftype) { + case NL80211_IFTYPE_P2P_CLIENT: + if (test_bit(BRCMF_VIF_STATUS_DISCONNECTING, &vif->sme_state)) + wait_for_disable = true; +@@ -2277,7 +2279,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiph + BRCMF_P2P_DISABLE_TIMEOUT); + + err = 0; +- if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE) { ++ if (iftype != NL80211_IFTYPE_P2P_DEVICE) { + brcmf_vif_clear_mgmt_ies(vif); + err = brcmf_p2p_release_p2p_if(vif); + } +@@ -2293,7 +2295,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiph + brcmf_remove_interface(vif->ifp, true); + + brcmf_cfg80211_arm_vif_event(cfg, NULL); +- if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE) ++ if (iftype != NL80211_IFTYPE_P2P_DEVICE) + p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = NULL; + + return err; -- 2.30.2