From patchwork Thu Oct 13 17:52:35 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 2135 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp404793wrs; Thu, 13 Oct 2022 10:55:56 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4jhmaBCpq9/pTJFzN4rZbA8Q6rQA4qD07t11sB8t52DuBpEa39DF1LbQr7Put2uE1KvVk4 X-Received: by 2002:a17:90a:9ec:b0:20a:e8e0:3f60 with SMTP id 99-20020a17090a09ec00b0020ae8e03f60mr1058468pjo.100.1665683756458; Thu, 13 Oct 2022 10:55:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1665683756; cv=none; d=google.com; s=arc-20160816; b=N/nGHF0xLqy7XdzU52P0nDA29GiftorVQpYGwheCs/A9/1jwKRmkpawbAsPjyUetWl Qahyty7GWOQB/2zTM0Bqa/zZj87/Y/iqtVFuoW2POsQlmEPfQYSSAjqO/jdzrlWZxYGX p7+AXuGwGHjWKzZbCN0KQDO/0YhP5QV0rT4RmAyEqgXzMdZmJF0v5K/hqSyinPpfJ2oz A21c4WsPiwcvYrJ/ZsdDnmloM1YhzgfH214U6ldZDWd1bVdL/BQe6VXyobBjUUoWCwSS uZhWGymbGOTjLXWJ6WVU5d+wjH6PFu9imzNblAt7nNBtd0amaPFoGlrCgqglqe7e6Huh e9cw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=IgTVTBK4Lqu2Sx9gG+DU96y6C0h9rnJk7crj8nib3Tc=; b=qVBqXEnLDhJVPp68vVUB+koxQIvL9aRk1YVI027vFfDyYSYeEnpb0TNDPnqR6ARKIh K+ShDEVmcYuxr306KUuqqvzK53fuSnrrQi81tNWjIfCq1+mI/eyjCxvZy1gfL1I+7kQf lSsYimO2byn090/+ay/gTw0LnzckyiQ+eafeGh9NskPdYd8LS5l5RrynADCQY4ifSW6V mkAaN8YCP8S877lF+YJRTrB9dZNmGPDYYoQtIv09CXxFsNyjuAjMDB0dw42b3stLX/KI 1Zt/Umnj72IwK0CjYQV374nrtekQM7mbetYte4tvsqpYM0r9Gr8CRFqvhmy5TOD3OtWC tbsg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=dL2+05V5; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id f12-20020a056a001acc00b00562e67620fesi1997pfv.192.2022.10.13.10.55.42; Thu, 13 Oct 2022 10:55:56 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=dL2+05V5; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229955AbiJMRzU (ORCPT + 99 others); Thu, 13 Oct 2022 13:55:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54148 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229927AbiJMRy1 (ORCPT ); Thu, 13 Oct 2022 13:54:27 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4606715201B; Thu, 13 Oct 2022 10:53:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B97C9B82026; Thu, 13 Oct 2022 17:53:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F790C433D6; Thu, 13 Oct 2022 17:53:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665683630; bh=+hWHjzuNL4/uWC9zqXql+Q2XpFqifgfw5cukpFp5D5I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dL2+05V5FlEPwL1rk5AmL8rtqNvPxMZ/P+XwlknWhJ/Ui9QclB6OIU8FSg9RobnIl gTpxGdAolIbXR5r5/Bdj0ewZtBw7bXmiuydIRj5atBfNGSgZhbQG7yhQD7SdA9TMxN Z8nU3FYCsBEfuMdzLPErZ3Mmrag09LaxEbMvf9kE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?utf-8?q?S=C3=B6nke_Huster?= , Johannes Berg Subject: [PATCH 5.4 34/38] wifi: cfg80211: avoid nontransmitted BSS list corruption Date: Thu, 13 Oct 2022 19:52:35 +0200 Message-Id: <20221013175145.382242160@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221013175144.245431424@linuxfoundation.org> References: <20221013175144.245431424@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746596010257817055?= X-GMAIL-MSGID: =?utf-8?q?1746596010257817055?= From: Johannes Berg commit bcca852027e5878aec911a347407ecc88d6fff7f upstream. If a non-transmitted BSS shares enough information (both SSID and BSSID!) with another non-transmitted BSS of a different AP, then we can find and update it, and then try to add it to the non-transmitted BSS list. We do a search for it on the transmitted BSS, but if it's not there (but belongs to another transmitted BSS), the list gets corrupted. Since this is an erroneous situation, simply fail the list insertion in this case and free the non-transmitted BSS. This fixes CVE-2022-42721. Reported-by: Sönke Huster Tested-by: Sönke Huster Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning") Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/wireless/scan.c | 9 +++++++++ 1 file changed, 9 insertions(+) --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -386,6 +386,15 @@ cfg80211_add_nontrans_list(struct cfg802 rcu_read_unlock(); + /* + * This is a bit weird - it's not on the list, but already on another + * one! The only way that could happen is if there's some BSSID/SSID + * shared by multiple APs in their multi-BSSID profiles, potentially + * with hidden SSID mixed in ... ignore it. + */ + if (!list_empty(&nontrans_bss->nontrans_list)) + return -EINVAL; + /* add to the list */ list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list); return 0;