mirror of
https://github.com/Telecominfraproject/wlan-ap.git
synced 2025-12-20 10:51:27 +00:00
111 lines
3.9 KiB
Diff
111 lines
3.9 KiB
Diff
From b9579c16128e6f53c344a5c0710f5d6bfb981e93 Mon Sep 17 00:00:00 2001
|
|
From: Johannes Berg <johannes.berg@intel.com>
|
|
Date: Tue, 29 Nov 2022 19:24:09 +0530
|
|
Subject: [PATCH 3/6] UPSTREAM: mac80211: fix MBSSID parsing use-after-free
|
|
|
|
When we parse a multi-BSSID element, we might point some
|
|
element pointers into the allocated nontransmitted_profile.
|
|
However, we free this before returning, causing UAF when the
|
|
relevant pointers in the parsed elements are accessed.
|
|
|
|
Fix this by not allocating the scratch buffer separately but
|
|
as part of the returned structure instead, that way, there
|
|
are no lifetime issues with it.
|
|
|
|
The scratch buffer introduction as part of the returned data
|
|
here is taken from MLO feature work done by Ilan.
|
|
|
|
This fixes CVE-2022-42719.
|
|
|
|
(Cherry picked from commit:ff05d4b45dd89b922578dac497dcabf57cf771c6)
|
|
(Source:https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git)
|
|
(Link: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/
|
|
commit/?id=ff05d4b45dd89b922578dac497dcabf57cf771c6)
|
|
|
|
Fixes: 5023b14cf4df ("mac80211: support profile split between elements")
|
|
Co-developed-by: Ilan Peer <ilan.peer@intel.com>
|
|
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
|
|
Reviewed-by: Kees Cook <keescook@chromium.org>
|
|
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Signed-off-by: Ganesh Babu Jothiram <quic_gjothira@quicinc.com>
|
|
---
|
|
net/mac80211/ieee80211_i.h | 8 ++++++++
|
|
net/mac80211/util.c | 29 +++++++++++++++--------------
|
|
2 files changed, 23 insertions(+), 14 deletions(-)
|
|
|
|
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
|
|
index 1faad33..2d09721 100644
|
|
--- a/net/mac80211/ieee80211_i.h
|
|
+++ b/net/mac80211/ieee80211_i.h
|
|
@@ -1745,6 +1745,14 @@ struct ieee802_11_elems {
|
|
|
|
/* whether a parse error occurred while retrieving these elements */
|
|
bool parse_error;
|
|
+
|
|
+ /*
|
|
+ * scratch buffer that can be used for various element parsing related
|
|
+ * tasks, e.g., element de-fragmentation etc.
|
|
+ */
|
|
+ size_t scratch_len;
|
|
+ u8 *scratch_pos;
|
|
+ u8 scratch[];
|
|
};
|
|
|
|
static inline struct ieee80211_local *hw_to_local(
|
|
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
|
|
index 6070437..519ac75 100644
|
|
--- a/net/mac80211/util.c
|
|
+++ b/net/mac80211/util.c
|
|
@@ -1504,24 +1504,27 @@ ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params)
|
|
const struct element *non_inherit = NULL;
|
|
u8 *nontransmitted_profile;
|
|
int nontransmitted_profile_len = 0;
|
|
+ size_t scratch_len = params->len;
|
|
|
|
- elems = kzalloc(sizeof(*elems), GFP_ATOMIC);
|
|
+ elems = kzalloc(sizeof(*elems) + scratch_len, GFP_ATOMIC);
|
|
if (!elems)
|
|
return NULL;
|
|
elems->ie_start = params->start;
|
|
elems->total_len = params->len;
|
|
|
|
- nontransmitted_profile = kmalloc(params->len, GFP_ATOMIC);
|
|
- if (nontransmitted_profile) {
|
|
- nontransmitted_profile_len =
|
|
- ieee802_11_find_bssid_profile(params->start, params->len,
|
|
- elems, params->bss,
|
|
- nontransmitted_profile);
|
|
- non_inherit =
|
|
- cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
|
|
- nontransmitted_profile,
|
|
- nontransmitted_profile_len);
|
|
- }
|
|
+ elems->scratch_len = scratch_len;
|
|
+ elems->scratch_pos = elems->scratch;
|
|
+
|
|
+ nontransmitted_profile = elems->scratch_pos;
|
|
+ nontransmitted_profile_len =
|
|
+ ieee802_11_find_bssid_profile(params->start, params->len,
|
|
+ elems, params->bss,
|
|
+ nontransmitted_profile);
|
|
+ elems->scratch_pos += nontransmitted_profile_len;
|
|
+ elems->scratch_len -= nontransmitted_profile_len;
|
|
+ non_inherit = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
|
|
+ nontransmitted_profile,
|
|
+ nontransmitted_profile_len);
|
|
|
|
elems->crc = _ieee802_11_parse_elems_full(params, elems, non_inherit);
|
|
|
|
@@ -1555,8 +1558,6 @@ ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params)
|
|
offsetofend(struct ieee80211_bssid_index, dtim_count))
|
|
elems->dtim_count = elems->bssid_index->dtim_count;
|
|
|
|
- kfree(nontransmitted_profile);
|
|
-
|
|
return elems;
|
|
}
|
|
|
|
--
|
|
2.17.1
|
|
|