Yu Zhao 492a81318e cfg80211: fix use-after-free in reg_process_hint() ...

[ Upstream commit 1db5852945 ]

reg_process_hint_country_ie() can free regulatory_request and return
REG_REQ_ALREADY_SET. We shouldn't use regulatory_request after it's
called. KASAN error was observed when this happens.

BUG: KASAN: use-after-free in reg_process_hint+0x839/0x8aa [cfg80211]
Read of size 4 at addr ffff8800c430d434 by task kworker/1:3/89
<snipped>
Workqueue: events reg_todo [cfg80211]
Call Trace:
 dump_stack+0xc1/0x10c
 ? _atomic_dec_and_lock+0x1ad/0x1ad
 ? _raw_spin_lock_irqsave+0xa0/0xd2
 print_address_description+0x86/0x26f
 ? reg_process_hint+0x839/0x8aa [cfg80211]
 kasan_report+0x241/0x29b
 reg_process_hint+0x839/0x8aa [cfg80211]
 reg_todo+0x204/0x5b9 [cfg80211]
 process_one_work+0x55f/0x8d0
 ? worker_detach_from_pool+0x1b5/0x1b5
 ? _raw_spin_unlock_irq+0x65/0xdd
 ? _raw_spin_unlock_irqrestore+0xf3/0xf3
 worker_thread+0x5dd/0x841
 ? kthread_parkme+0x1d/0x1d
 kthread+0x270/0x285
 ? pr_cont_work+0xe3/0xe3
 ? rcu_read_unlock_sched_notrace+0xca/0xca
 ret_from_fork+0x22/0x40

Allocated by task 2718:
 set_track+0x63/0xfa
 __kmalloc+0x119/0x1ac
 regulatory_hint_country_ie+0x38/0x329 [cfg80211]
 __cfg80211_connect_result+0x854/0xadd [cfg80211]
 cfg80211_rx_assoc_resp+0x3bc/0x4f0 [cfg80211]
smsc95xx v1.0.6
 ieee80211_sta_rx_queued_mgmt+0x1803/0x7ed5 [mac80211]
 ieee80211_iface_work+0x411/0x696 [mac80211]
 process_one_work+0x55f/0x8d0
 worker_thread+0x5dd/0x841
 kthread+0x270/0x285
 ret_from_fork+0x22/0x40

Freed by task 89:
 set_track+0x63/0xfa
 kasan_slab_free+0x6a/0x87
 kfree+0xdc/0x470
 reg_process_hint+0x31e/0x8aa [cfg80211]
 reg_todo+0x204/0x5b9 [cfg80211]
 process_one_work+0x55f/0x8d0
 worker_thread+0x5dd/0x841
 kthread+0x270/0x285
 ret_from_fork+0x22/0x40
<snipped>

Signed-off-by: Yu Zhao <yuzhao@google.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2018-11-04 14:52:40 +01:00

..

.gitignore

…

ap.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

chan.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

core.c

cfg80211: limit wiphy names to 128 bytes

2018-05-25 16:17:35 +02:00

core.h

mac80211_hwsim: validate number of different channels

2018-02-25 11:07:45 +01:00

db.txt

…

debugfs.c

cfg80211 debugfs: Cleanup some checkpatch issues

2017-02-08 09:15:59 +01:00

debugfs.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ethtool.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

genregdb.awk

wireless: fixup genregdb.awk for remove of antenna gain from wireless-regd

2014-07-21 12:24:20 +02:00

ibss.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

Kconfig

cfg80211: Fix some linguistics in Kconfig

2016-02-24 09:04:23 +01:00

lib80211_crypt_ccmp.c

lib80211: ratelimit key index mismatch

2015-12-04 14:43:32 +01:00

lib80211_crypt_tkip.c

wireless: fix bogus maybe-uninitialized warning

2016-11-17 08:46:38 +02:00

lib80211_crypt_wep.c

lib80211: Use skcipher and ahash

2016-01-27 20:36:03 +08:00

lib80211.c

lib80211: remove unused print_ssid()

2014-10-14 02:18:27 +02:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

mesh.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

mlme.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nl80211.c

nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds

2018-11-04 14:52:39 +01:00

nl80211.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ocb.c

cfg80211: ocb: Fix null pointer deref if join_ocb is unimplemented

2015-12-04 14:43:32 +01:00

of.c

cfg80211: support ieee80211-freq-limit DT property

2017-01-06 14:01:13 +01:00

radiotap.c

cfg80211: add radiotap VHT info to rtap_namespace_sizes

2016-02-24 09:04:41 +01:00

rdev-ops.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

reg.c

cfg80211: fix use-after-free in reg_process_hint()

2018-11-04 14:52:40 +01:00

reg.h

cfg80211: Share Channel DFS state across wiphys of same DFS domain

2017-03-06 13:54:20 +01:00

regdb.h

…

scan.c

cfg80211: Address some corner cases in scan result channel updating

2018-11-04 14:52:37 +01:00

sme.c

cfg80211: clear wep keys after disconnection

2018-05-30 07:51:58 +02:00

sysfs.c

cfg80211: check rdev resume callback only for registered wiphy

2017-03-29 09:11:29 +02:00

sysfs.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

trace.c

…

trace.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

util.c

cfg80211: fix a type issue in ieee80211_chandef_to_operating_class()

2018-10-10 08:54:21 +02:00

wext-compat.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

wext-compat.h

cfg80211-wext: export symbols only when needed

2015-02-28 21:31:09 +01:00

wext-core.c

dev_ioctl: copy only the smaller struct iwreq for wext

2017-06-14 13:52:44 +02:00

wext-priv.c

…

wext-proc.c

…

wext-sme.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

wext-spy.c

…