From patchwork Thu Oct 13 17:53:04 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 2234 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp412622wrs; Thu, 13 Oct 2022 11:11:08 -0700 (PDT) X-Google-Smtp-Source: AMsMyM5/MNzIw/vBjyygiUypvGYb2En5kbdNbDd5oruOtSB3h4kF79ZLDuLRRBXdxi1IhnU0EmyC X-Received: by 2002:a17:90b:3d8:b0:20a:8e90:8e8c with SMTP id go24-20020a17090b03d800b0020a8e908e8cmr1114061pjb.138.1665684668689; Thu, 13 Oct 2022 11:11:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1665684668; cv=none; d=google.com; s=arc-20160816; b=fPtJ27lCIe3TTDioOQZNaLxLkoGeyonIHphjONlGEmYsiYzy6SaHp0bFE2u45zV0Y6 eJELbf/zx00rUAXp08ndj/5/pC5lfXsuynLqjz54nxhai7CUgUwoJkpTNSLCNh1zvXfm R0COYBYz5ex9DQSymUov6hsBlb3v7MGPTFUb1eo8Sybd8rkziDLnN8bzxHfV2jz4ANQV m7+x8JBdXv89lo/Ho3qvoqpj9tjCgHUwG3QWv+a5C6IacZhSBENROWVPdRYbUpkBNXyA C+q/xF0JI6+42ZcvrLeiZ5HwXW+Po0DJ6CXRJ2L/d6BvVfOCXEPxr5/3gURnAGZ8B4IQ S9Cg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=dv3Kk0DV/VYeKP/SkwjmD9vtZ6ZgGQfYtEu9WsCBeMk=; b=t5ERMTTSBpM0PPK9hqsJE7oYN+Hw9X8woMbto3nFxtijbkj5xHCEus1unm/1mUPMq2 lBgr68LMQT9/QNfmeErnOAwTNESyvYtJP4dXE0gJlaXrosLoimvGL+98+Jwou5eN2N97 i78oiGY1V6ApUvwhN9GFP6UsePMc92FHFRPpXzTdzUVbjsjfhDmPtVJQvlYx7UNvEU4T X/QcfgdKgLUWfcx14/1KF11oGVA7XvpQpkGLKktHFsiOxSajS6tfmBeF80x2nNj6f3YO Xf80KcyZDsEk2uMGrrCkPN/rsHYbUPy/5tGfw7Xdc8ew1A3gxFIetbGbPKx+s4WTwsFh Yl2g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=aLTonID1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id x185-20020a6386c2000000b0043961d07372si37844pgd.585.2022.10.13.11.10.55; Thu, 13 Oct 2022 11:11:08 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=aLTonID1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231209AbiJMSKo (ORCPT + 99 others); Thu, 13 Oct 2022 14:10:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60108 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231446AbiJMSKJ (ORCPT ); Thu, 13 Oct 2022 14:10:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E393B15625F; Thu, 13 Oct 2022 11:07:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EABC86192E; Thu, 13 Oct 2022 18:01:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 03451C433D7; Thu, 13 Oct 2022 18:01:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665684104; bh=SsMZnV5IRg+VfGQh81XQuLjXEJU1N9vepNOsf1+r8VU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aLTonID16sFXFtCymOfbq00eVFbCSXG9GqGBc8P0DmoqgYo0qPc8kFVgNUse+LTrb bEEqmEYPzLBDkYL7yGCvQs3GwrkVYETh2AFH2bOZKdFywcfDlDeeIMV80w/ymgHHlb S3uaz0CEhaBKJ26gc6PplqiINoic819laNuMvu/w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?utf-8?q?S=C3=B6nke_Huster?= , Johannes Berg Subject: [PATCH 6.0 26/34] wifi: cfg80211: avoid nontransmitted BSS list corruption Date: Thu, 13 Oct 2022 19:53:04 +0200 Message-Id: <20221013175147.193301522@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221013175146.507746257@linuxfoundation.org> References: <20221013175146.507746257@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746596967053149954?= X-GMAIL-MSGID: =?utf-8?q?1746596967053149954?= From: Johannes Berg commit bcca852027e5878aec911a347407ecc88d6fff7f upstream. If a non-transmitted BSS shares enough information (both SSID and BSSID!) with another non-transmitted BSS of a different AP, then we can find and update it, and then try to add it to the non-transmitted BSS list. We do a search for it on the transmitted BSS, but if it's not there (but belongs to another transmitted BSS), the list gets corrupted. Since this is an erroneous situation, simply fail the list insertion in this case and free the non-transmitted BSS. This fixes CVE-2022-42721. Reported-by: Sönke Huster Tested-by: Sönke Huster Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning") Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/wireless/scan.c | 9 +++++++++ 1 file changed, 9 insertions(+) --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -423,6 +423,15 @@ cfg80211_add_nontrans_list(struct cfg802 rcu_read_unlock(); + /* + * This is a bit weird - it's not on the list, but already on another + * one! The only way that could happen is if there's some BSSID/SSID + * shared by multiple APs in their multi-BSSID profiles, potentially + * with hidden SSID mixed in ... ignore it. + */ + if (!list_empty(&nontrans_bss->nontrans_list)) + return -EINVAL; + /* add to the list */ list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list); return 0;