package/kernel/mac80211/patches/352-mac80211-fix-use-after-free-in-defragmentation.patch

   1 From: Johannes Berg <johannes.berg@intel.com>
   2 Date: Mon, 3 Nov 2014 14:29:09 +0100
   3 Subject: [PATCH] mac80211: fix use-after-free in defragmentation
   4
   5 Upon receiving the last fragment, all but the first fragment
   6 are freed, but the multicast check for statistics at the end
   7 of the function refers to the current skb (the last fragment)
   8 causing a use-after-free bug.
   9
  10 Since multicast frames cannot be fragmented and we check for
  11 this early in the function, just modify that check to also
  12 do the accounting to fix the issue.
  13
  14 Cc: stable@vger.kernel.org
  15 Reported-by: Yosef Khyal <yosefx.khyal@intel.com>
  16 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  17 ---
  18
  19 --- a/net/mac80211/rx.c
  20 +++ b/net/mac80211/rx.c
  21 @@ -1678,11 +1678,14 @@ ieee80211_rx_h_defragment(struct ieee802
  22         sc = le16_to_cpu(hdr->seq_ctrl);
  23         frag = sc & IEEE80211_SCTL_FRAG;
  24
  25 -       if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
  26 -                  is_multicast_ether_addr(hdr->addr1))) {
  27 -               /* not fragmented */
  28 +       if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
  29 +               goto out;
  30 +
  31 +       if (is_multicast_ether_addr(hdr->addr1)) {
  32 +               rx->local->dot11MulticastReceivedFrameCount++;
  33                 goto out;
  34         }
  35 +
  36         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
  37
  38         if (skb_linearize(rx->skb))
  39 @@ -1775,10 +1778,7 @@ ieee80211_rx_h_defragment(struct ieee802
  40   out:
  41         if (rx->sta)
  42                 rx->sta->rx_packets++;
  43 -       if (is_multicast_ether_addr(hdr->addr1))
  44 -               rx->local->dot11MulticastReceivedFrameCount++;
  45 -       else
  46 -               ieee80211_led_rx(rx->local);
  47 +       ieee80211_led_rx(rx->local);
  48         return RX_CONTINUE;
  49  }
  50