From patchwork Thu Oct 13 17:52:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 2277 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp421974wrs; Thu, 13 Oct 2022 11:35:06 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4YYyiTYTz2ttWjma4pdag2DE9IiXGF+PttmZicxybRf1DO86QJQ15YuhOtal24uCMARn5w X-Received: by 2002:a17:907:c10:b0:78d:fd66:8d63 with SMTP id ga16-20020a1709070c1000b0078dfd668d63mr805261ejc.3.1665686106665; Thu, 13 Oct 2022 11:35:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1665686106; cv=none; d=google.com; s=arc-20160816; b=uV8jKMPKd908scik+da5sQ49SWvWGVJY/QbavwkU2+rmCWDb+cXqLIziSqYv764qOA JaOdM77GUM3dUwGfjLxklxbUQyF+8sVP3MBKNelQeY4E/w0LcG88Cq65GMCrf/c5NMOu 4SakwqCDFdNOTNpX0HX1hsTJWDGj0TS3WskH8TEjAl9idvieK9I8W/FiTluLzoFniLY8 R7vqXuHO2mPksE5+hzlC9nheATGvila405WQz6ontWvOYt1E0vE/pkhqpiXGIHbcj7Rb PNpHHqRCNPwwHlXr+jV2/IBWeYpaFA278mfCHWQdHLjucRBhi15IN+Kx+4Uq+Jsl5PAz ZopQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=FGX5hjdFUAV5+kHnF4nTphpEH17vBbEEEYSfPXFZUII=; b=f/++/xS2x3595nWVYWRssjrHhm/Ltmw2ckOdonV04ad3EZ7d22d4P2feND15L/BmrH g/9J7r1JbcL8q/R4eHj8Z3RnIeZaQUBRkElE+hhIrs4+DU9yeC2LnQx4X0KkS1e+Id5U gRBOxH5LPip3Cc6ZRQGju317Iv2n7Iwmnm1s9eqBXpfHzLtfXTUhIr9XavfzZ9BWJYiq DAV2F28lySsbK/Z2Wheq9xBUMPzCVzttDm39BbMQ4K3TX4Qbrg8EiStxQN4+4S8i0VJb vAQNLNAHn10FPhknrQSt+9QjOf4CNAj0IWASBnfQ0c7lLPS0NQAb29M3qVVB9aHG43pg fypw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="pV9DJ7/h"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id b18-20020a1709065e5200b00781ea213f99si336242eju.173.2022.10.13.11.34.39; Thu, 13 Oct 2022 11:35:06 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="pV9DJ7/h"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232050AbiJMSc0 (ORCPT + 99 others); Thu, 13 Oct 2022 14:32:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52736 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232029AbiJMScE (ORCPT ); Thu, 13 Oct 2022 14:32:04 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2F363194216; Thu, 13 Oct 2022 11:28:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7D56AB8206C; Thu, 13 Oct 2022 18:00:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A8AABC433C1; Thu, 13 Oct 2022 18:00:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665684035; bh=iFDYfkZv+13hUjNnwoj0yShUJzr5cGRa6UiH4O+3Hu8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pV9DJ7/h7FGsGGF8d4EaYUWod/kjDVjxjAjTD/qG4kmM2x/Q9YzRdZ11gKkCJt5ZI 1r3SfpIpP+SM5AS0BeZRbVi42as1DiZ60hP7kIs1QG0FUht6LjaT60uNP7UshnzQi2 TxHs7GWvlkrWBt2vs2W5y9+dtq0F3OtOUkVqs7yA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ilan Peer , Kees Cook , Johannes Berg Subject: [PATCH 5.19 22/33] wifi: mac80211: fix MBSSID parsing use-after-free Date: Thu, 13 Oct 2022 19:52:54 +0200 Message-Id: <20221013175146.021304834@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221013175145.236739253@linuxfoundation.org> References: <20221013175145.236739253@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746598475013691315?= X-GMAIL-MSGID: =?utf-8?q?1746598475013691315?= From: Johannes Berg commit ff05d4b45dd89b922578dac497dcabf57cf771c6 upstream. When we parse a multi-BSSID element, we might point some element pointers into the allocated nontransmitted_profile. However, we free this before returning, causing UAF when the relevant pointers in the parsed elements are accessed. Fix this by not allocating the scratch buffer separately but as part of the returned structure instead, that way, there are no lifetime issues with it. The scratch buffer introduction as part of the returned data here is taken from MLO feature work done by Ilan. This fixes CVE-2022-42719. Fixes: 5023b14cf4df ("mac80211: support profile split between elements") Co-developed-by: Ilan Peer Signed-off-by: Ilan Peer Reviewed-by: Kees Cook Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/mac80211/ieee80211_i.h | 8 ++++++++ net/mac80211/util.c | 31 ++++++++++++++++--------------- 2 files changed, 24 insertions(+), 15 deletions(-) --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -1640,6 +1640,14 @@ struct ieee802_11_elems { /* whether a parse error occurred while retrieving these elements */ bool parse_error; + + /* + * scratch buffer that can be used for various element parsing related + * tasks, e.g., element de-fragmentation etc. + */ + size_t scratch_len; + u8 *scratch_pos; + u8 scratch[]; }; static inline struct ieee80211_local *hw_to_local( --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -1503,25 +1503,28 @@ struct ieee802_11_elems *ieee802_11_pars const struct element *non_inherit = NULL; u8 *nontransmitted_profile; int nontransmitted_profile_len = 0; + size_t scratch_len = len; - elems = kzalloc(sizeof(*elems), GFP_ATOMIC); + elems = kzalloc(sizeof(*elems) + scratch_len, GFP_ATOMIC); if (!elems) return NULL; elems->ie_start = start; elems->total_len = len; + elems->scratch_len = scratch_len; + elems->scratch_pos = elems->scratch; - nontransmitted_profile = kmalloc(len, GFP_ATOMIC); - if (nontransmitted_profile) { - nontransmitted_profile_len = - ieee802_11_find_bssid_profile(start, len, elems, - transmitter_bssid, - bss_bssid, - nontransmitted_profile); - non_inherit = - cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, - nontransmitted_profile, - nontransmitted_profile_len); - } + nontransmitted_profile = elems->scratch_pos; + nontransmitted_profile_len = + ieee802_11_find_bssid_profile(start, len, elems, + transmitter_bssid, + bss_bssid, + nontransmitted_profile); + elems->scratch_pos += nontransmitted_profile_len; + elems->scratch_len -= nontransmitted_profile_len; + non_inherit = + cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, + nontransmitted_profile, + nontransmitted_profile_len); crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter, crc, non_inherit); @@ -1550,8 +1553,6 @@ struct ieee802_11_elems *ieee802_11_pars offsetofend(struct ieee80211_bssid_index, dtim_count)) elems->dtim_count = elems->bssid_index->dtim_count; - kfree(nontransmitted_profile); - elems->crc = crc; return elems;