From patchwork Thu Oct 13 17:53:01 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 2298 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp428335wrs; Thu, 13 Oct 2022 11:51:41 -0700 (PDT) X-Google-Smtp-Source: AMsMyM56rt48iHvzHrXC3DysX14qgMr6Vxmk4OnvJKsRIgfSWM5BxeUrKHjGoMugYHyddKhJBqCG X-Received: by 2002:a17:903:1053:b0:185:37cb:da04 with SMTP id f19-20020a170903105300b0018537cbda04mr1310076plc.108.1665687101582; Thu, 13 Oct 2022 11:51:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1665687101; cv=none; d=google.com; s=arc-20160816; b=ySxQymeflTYs4Nx2qSTqsDYxXTHUJudXCr3CZ7a6/8t31P5MRC0Lqwd6M0MHVAvk+V bvgK0LRXMzkduxfeGKlbp9bpV0VvjCSS7S615WnZhVmK46nDynHvhtLKZ5pD1MotV2SH 0wGsZMqt9lw0NOK+beywzUeFY+jvz/cekmw/TpFiEg3g++EZk9YnFcycOJFhsiG2SNoZ 79SzNebn+013z0GBGM0rVtGH/UNe/kFHrTsgUWmCtGtZ3F0f+EpyTm+1DcpF76TeBm9h 1LZoouiwDow/FhCD9JZE72cNQLv45fYg2gT7UZolWYgXLpF7EMsUGcS0T37PzzWZBGxx rhLw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=6iZ8nODMbAT3X3Z8eeVKhhNUepqQlPk45jLrsRhR0xM=; b=wPSh+nIkYuKG8AdP7rLieSWrYfoRWuq/VV6bbPW+q6Lcs3iO+Zx+IlGPr7LZsPOM6l 1I5lzd6l5g6ixeZP/Mf3u7VjeeI03C7deh24Vhv/DjJLpF8A0PZoL2g/wk6JTTJ8mnsG kMAyVdziKih+7hNxGUBUmUJK+4u/f84j1XN65mj3w95MtokvHEMpveY621oMytcKu73c 9piNVC7o8RPTnf+CzQlwi/rf1Y0LxLSHgMxRKEhsvx1vpfmIq0ymyx62AmCDTJmtaVLp ZD3lZnqT3OwX45kzjb+4eSF64ENTyv1imqCBu4r0FGTwf3ysdykU03WCRX4EIosJJeYj 6siw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Hy2H85DM; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id h8-20020a170902f54800b0017693dbd8cdsi436349plf.551.2022.10.13.11.51.29; Thu, 13 Oct 2022 11:51:41 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Hy2H85DM; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231961AbiJMSd5 (ORCPT + 99 others); Thu, 13 Oct 2022 14:33:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44122 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229649AbiJMSdV (ORCPT ); Thu, 13 Oct 2022 14:33:21 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9CBA517FD5F; Thu, 13 Oct 2022 11:29:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A026761A51; Thu, 13 Oct 2022 18:01:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AFEA8C433D7; Thu, 13 Oct 2022 18:01:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665684096; bh=Ajm14oqIOS8bNZ+O27M/3u4Vz08BqrePq7KdTFY7v80=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Hy2H85DMOI2HJ2ZZn20GJS61mnFdnhcLrmxKapiO0JL5uVO8wO+v8VfXBBKYmgUh9 HByX3njDxrMwhaCjbGnhbJ+RgOLOOz9KzXw14wI+IBf8fWkASFdoG2KJwi1vR0o+GM WTaHk6mMU3/Ew4ExqI12h3cHrV2VLJIyjAM0bUYc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ilan Peer , Kees Cook , Johannes Berg Subject: [PATCH 6.0 23/34] wifi: mac80211: fix MBSSID parsing use-after-free Date: Thu, 13 Oct 2022 19:53:01 +0200 Message-Id: <20221013175147.118965481@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221013175146.507746257@linuxfoundation.org> References: <20221013175146.507746257@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746599518251198226?= X-GMAIL-MSGID: =?utf-8?q?1746599518251198226?= From: Johannes Berg commit ff05d4b45dd89b922578dac497dcabf57cf771c6 upstream. When we parse a multi-BSSID element, we might point some element pointers into the allocated nontransmitted_profile. However, we free this before returning, causing UAF when the relevant pointers in the parsed elements are accessed. Fix this by not allocating the scratch buffer separately but as part of the returned structure instead, that way, there are no lifetime issues with it. The scratch buffer introduction as part of the returned data here is taken from MLO feature work done by Ilan. This fixes CVE-2022-42719. Fixes: 5023b14cf4df ("mac80211: support profile split between elements") Co-developed-by: Ilan Peer Signed-off-by: Ilan Peer Reviewed-by: Kees Cook Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/mac80211/ieee80211_i.h | 8 ++++++++ net/mac80211/util.c | 28 ++++++++++++++-------------- 2 files changed, 22 insertions(+), 14 deletions(-) --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -1704,6 +1704,14 @@ struct ieee802_11_elems { /* whether a parse error occurred while retrieving these elements */ bool parse_error; + + /* + * scratch buffer that can be used for various element parsing related + * tasks, e.g., element de-fragmentation etc. + */ + size_t scratch_len; + u8 *scratch_pos; + u8 scratch[]; }; static inline struct ieee80211_local *hw_to_local( --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -1503,24 +1503,26 @@ ieee802_11_parse_elems_full(struct ieee8 const struct element *non_inherit = NULL; u8 *nontransmitted_profile; int nontransmitted_profile_len = 0; + size_t scratch_len = params->len; - elems = kzalloc(sizeof(*elems), GFP_ATOMIC); + elems = kzalloc(sizeof(*elems) + scratch_len, GFP_ATOMIC); if (!elems) return NULL; elems->ie_start = params->start; elems->total_len = params->len; + elems->scratch_len = scratch_len; + elems->scratch_pos = elems->scratch; - nontransmitted_profile = kmalloc(params->len, GFP_ATOMIC); - if (nontransmitted_profile) { - nontransmitted_profile_len = - ieee802_11_find_bssid_profile(params->start, params->len, - elems, params->bss, - nontransmitted_profile); - non_inherit = - cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, - nontransmitted_profile, - nontransmitted_profile_len); - } + nontransmitted_profile = elems->scratch_pos; + nontransmitted_profile_len = + ieee802_11_find_bssid_profile(params->start, params->len, + elems, params->bss, + nontransmitted_profile); + elems->scratch_pos += nontransmitted_profile_len; + elems->scratch_len -= nontransmitted_profile_len; + non_inherit = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, + nontransmitted_profile, + nontransmitted_profile_len); elems->crc = _ieee802_11_parse_elems_full(params, elems, non_inherit); @@ -1554,8 +1556,6 @@ ieee802_11_parse_elems_full(struct ieee8 offsetofend(struct ieee80211_bssid_index, dtim_count)) elems->dtim_count = elems->bssid_index->dtim_count; - kfree(nontransmitted_profile); - return elems; }