Markus Theil
fffbb85289
mac80211: fix double free in ibss_leave ...
commit 3bd801b14e0c5d29eeddc7336558beb3344efaa3 upstream.
Clear beacon ie pointer and ie length after free
in order to prevent double free.
==================================================================
BUG: KASAN: double-free or invalid-free \
in ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876
CPU: 0 PID: 8472 Comm: syz-executor100 Not tainted 5.11.0-rc6-syzkaller #0
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x107/0x163 lib/dump_stack.c:120
print_address_description.constprop.0.cold+0x5b/0x2c6 mm/kasan/report.c:230
kasan_report_invalid_free+0x51/0x80 mm/kasan/report.c:355
____kasan_slab_free+0xcc/0xe0 mm/kasan/common.c:341
kasan_slab_free include/linux/kasan.h:192 [inline]
__cache_free mm/slab.c:3424 [inline]
kfree+0xed/0x270 mm/slab.c:3760
ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876
rdev_leave_ibss net/wireless/rdev-ops.h:545 [inline]
__cfg80211_leave_ibss+0x19a/0x4c0 net/wireless/ibss.c:212
__cfg80211_leave+0x327/0x430 net/wireless/core.c:1172
cfg80211_leave net/wireless/core.c:1221 [inline]
cfg80211_netdev_notifier_call+0x9e8/0x12c0 net/wireless/core.c:1335
notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2040
call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
call_netdevice_notifiers net/core/dev.c:2066 [inline]
__dev_close_many+0xee/0x2e0 net/core/dev.c:1586
__dev_close net/core/dev.c:1624 [inline]
__dev_change_flags+0x2cb/0x730 net/core/dev.c:8476
dev_change_flags+0x8a/0x160 net/core/dev.c:8549
dev_ifsioc+0x210/0xa70 net/core/dev_ioctl.c:265
dev_ioctl+0x1b1/0xc40 net/core/dev_ioctl.c:511
sock_do_ioctl+0x148/0x2d0 net/socket.c:1060
sock_ioctl+0x477/0x6a0 net/socket.c:1177
vfs_ioctl fs/ioctl.c:48 [inline]
__do_sys_ioctl fs/ioctl.c:753 [inline]
__se_sys_ioctl fs/ioctl.c:739 [inline]
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Reported-by: syzbot+93976391bf299d425f44@syzkaller.appspotmail.com
Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
Link: https://lore.kernel.org/r/20210213133653.367130-1-markus.theil@tu-ilmenau.de
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-30 14:41:43 +02:00
2016-10-17 16:14:04 +02:00
2016-10-17 16:14:04 +02:00
2016-10-17 16:14:04 +02:00
2016-10-17 16:14:04 +02:00
2016-10-17 16:14:04 +02:00
2016-10-17 16:14:04 +02:00
2017-03-15 10:02:47 +08:00
2018-11-10 07:42:47 -08:00
2021-03-30 14:41:41 +02:00
2017-12-09 22:01:51 +01:00
2016-02-24 09:04:38 +01:00
2019-10-29 09:15:03 +01:00
2017-01-12 11:39:23 +01:00
2016-09-30 13:29:31 +02:00
2021-02-10 09:09:25 +01:00
2019-04-27 09:34:45 +02:00
2018-11-10 07:42:47 -08:00
2021-03-30 14:41:43 +02:00
2021-02-03 23:19:51 +01:00
2021-02-03 23:19:51 +01:00
2018-09-26 08:36:33 +02:00
2016-02-24 09:04:38 +01:00
2018-10-10 08:53:19 +02:00
2021-03-03 17:44:34 +01:00
2020-12-29 13:44:48 +01:00
2018-03-24 11:00:17 +01:00
2017-11-30 08:39:13 +00:00
2019-07-21 09:05:52 +02:00
2016-04-05 21:34:53 +02:00
2020-05-10 10:28:03 +02:00
2016-04-06 13:18:15 +02:00
2017-10-05 09:43:58 +02:00
2017-03-15 10:02:47 +08:00
2021-02-10 09:09:25 +01:00
2016-04-05 11:59:05 +02:00
2020-01-29 10:24:30 +01:00
2020-11-24 13:03:09 +01:00
2020-11-24 13:03:09 +01:00
2021-02-10 09:09:24 +01:00
2016-09-15 16:46:16 +02:00
2018-05-30 07:50:28 +02:00
2020-11-24 13:03:09 +01:00
2018-11-10 07:42:47 -08:00
2020-05-10 10:28:03 +02:00
2019-10-05 12:30:09 +02:00
2020-02-05 13:05:50 +00:00
2016-02-24 09:04:38 +01:00
2016-09-30 13:45:44 +02:00
2020-11-18 18:26:26 +01:00
2020-03-11 07:53:02 +01:00
2020-10-14 09:48:12 +02:00
2018-01-17 09:38:49 +01:00
2019-07-10 09:55:35 +02:00
fffbb85289