aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRafał Miłecki <rafal@milecki.pl>2018-08-16 09:48:51 +0200
committerRafał Miłecki <rafal@milecki.pl>2018-08-16 13:07:09 +0200
commitf8c364b7204259b379c96f3e04d65ceed0a8fbe7 (patch)
tree9ec1a435342ea5001b44407519781da3469ca598
parent85e6ac468efc980ef89149dcbab23e492ece8e97 (diff)
downloadupstream-f8c364b7204259b379c96f3e04d65ceed0a8fbe7.tar.gz
upstream-f8c364b7204259b379c96f3e04d65ceed0a8fbe7.tar.bz2
upstream-f8c364b7204259b379c96f3e04d65ceed0a8fbe7.zip
mac80211: brcmfmac: backport use-after-free fix from 4.11
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-rw-r--r--package/kernel/mac80211/Makefile2
-rw-r--r--package/kernel/mac80211/patches/318-v4.11-0007-brcmfmac-use-local-iftype-avoiding-use-after-free-of.patch61
2 files changed, 62 insertions, 1 deletions
diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index 0a4cbc8ab4..697401d316 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -11,7 +11,7 @@ include $(INCLUDE_DIR)/kernel.mk
PKG_NAME:=mac80211
PKG_VERSION:=2017-01-31
-PKG_RELEASE:=5
+PKG_RELEASE:=6
PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
PKG_BACKPORT_VERSION:=
PKG_HASH:=75e6d39e34cf156212a2509172a4a62b673b69eb4a1d9aaa565f7fa719fa2317
diff --git a/package/kernel/mac80211/patches/318-v4.11-0007-brcmfmac-use-local-iftype-avoiding-use-after-free-of.patch b/package/kernel/mac80211/patches/318-v4.11-0007-brcmfmac-use-local-iftype-avoiding-use-after-free-of.patch
new file mode 100644
index 0000000000..53dc8fe8fc
--- /dev/null
+++ b/package/kernel/mac80211/patches/318-v4.11-0007-brcmfmac-use-local-iftype-avoiding-use-after-free-of.patch
@@ -0,0 +1,61 @@
+From d77facb88448cdeaaa3adba5b9704a48ac2ac8d6 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 28 Mar 2017 09:11:30 +0100
+Subject: [PATCH] brcmfmac: use local iftype avoiding use-after-free of virtual
+ interface
+
+A use-after-free was found using KASAN. In brcmf_p2p_del_if() the virtual
+interface is removed using call to brcmf_remove_interface(). After that
+the virtual interface instance has been freed and should not be referenced.
+Solve this by storing the nl80211 iftype in local variable, which is used
+in a couple of places anyway.
+
+Cc: stable@vger.kernel.org # 4.10.x, 4.9.x
+Reported-by: Daniel J Blueman <daniel@quora.org>
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -2240,14 +2240,16 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
+ struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
+ struct brcmf_p2p_info *p2p = &cfg->p2p;
+ struct brcmf_cfg80211_vif *vif;
++ enum nl80211_iftype iftype;
+ bool wait_for_disable = false;
+ int err;
+
+ brcmf_dbg(TRACE, "delete P2P vif\n");
+ vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
+
++ iftype = vif->wdev.iftype;
+ brcmf_cfg80211_arm_vif_event(cfg, vif);
+- switch (vif->wdev.iftype) {
++ switch (iftype) {
+ case NL80211_IFTYPE_P2P_CLIENT:
+ if (test_bit(BRCMF_VIF_STATUS_DISCONNECTING, &vif->sme_state))
+ wait_for_disable = true;
+@@ -2277,7 +2279,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
+ BRCMF_P2P_DISABLE_TIMEOUT);
+
+ err = 0;
+- if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE) {
++ if (iftype != NL80211_IFTYPE_P2P_DEVICE) {
+ brcmf_vif_clear_mgmt_ies(vif);
+ err = brcmf_p2p_release_p2p_if(vif);
+ }
+@@ -2293,7 +2295,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiph
+ brcmf_remove_interface(vif->ifp, true);
+
+ brcmf_cfg80211_arm_vif_event(cfg, NULL);
+- if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE)
++ if (iftype != NL80211_IFTYPE_P2P_DEVICE)
+ p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = NULL;
+
+ return err;