Message ID | 20221013175148.476986632@linuxfoundation.org |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp407038wrs; Thu, 13 Oct 2022 11:01:26 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4V0+1qe204F7KgMQdlnId7cFMkAfFR3+WpFhVlqk+bY0I9sP7t4zgZIlfAmolltj8AxMhP X-Received: by 2002:aa7:d7c5:0:b0:459:fad8:fd2 with SMTP id e5-20020aa7d7c5000000b00459fad80fd2mr869064eds.336.1665684086680; Thu, 13 Oct 2022 11:01:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1665684086; cv=none; d=google.com; s=arc-20160816; b=mpSC1OBNYfvelnAqvh03U2+aHRzEYKACAyWWy2vWi/iw7OSUuVy8x5FdheQ1EMVDM0 HI0Fl1KsUk3eYWQa8rhV7Ow39CXDMs7TW9TVTeQ7ePvC3qFxdGdAaMLoMjtRhiwiyLPM wnwPLaerqxeJecXTy4tTANsNjSyc417zBjCoCf7rrc2QBcjkMr1pkac0QqoDnC9l58X4 sMRUAwkq8q6Uu+2JeAB7vKy9LlBYumieP/45niV5hzmOJC4VdIFm7jiyltGgWCT1fs5L cgwbsgt0yVMuCe94uxzBwSh3vaZIdxM2GHIFqA54qpkaGEJCywY/j3uRlvD1lnAORw5h RtUA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=zA4hmFjbp1+Z1cJgLhJ7yUJxLdNmtdAgfhPM66Q/sd8=; b=mxWzX8jijycS4QN3JpXwrgMrS1KhJeajItwvBDuN5txGYdTjSYPNbOpFj3MD+RFh2m T/jb+tIkPEXUZQcftWIOhQBXaAhO3xcYk6MM6tP4WaB5bSJvqbxLCTNBsR3DW05VP9xY pOVj/KqfXqpcL8YmtJDpSOpaOQKvHRTWN3JWxPwQl10OoKFbgt7Yb/CyRpihba1cTlRn LPsvwWi20GqHElvd+bZ2NO7sz4wocGq2PxK86heThmiWE8FLPUvl+5RZ3aGtk9Lmd+P/ lCMbqjO7q7lYJg1lN0z6TxkoTtspT9zMjuwJd7rxU+EJC1u2nGoZapuyLiiIct6u709Y YhOg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=mngPvIZL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id i15-20020a05640242cf00b0045a1dbedd92si401114edc.35.2022.10.13.11.01.01; Thu, 13 Oct 2022 11:01:26 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=mngPvIZL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230225AbiJMR67 (ORCPT <rfc822;ouuuleilei@gmail.com> + 99 others); Thu, 13 Oct 2022 13:58:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54236 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230166AbiJMR5r (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Thu, 13 Oct 2022 13:57:47 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 89AB0F58E; Thu, 13 Oct 2022 10:57:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A4842B82040; Thu, 13 Oct 2022 17:57:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC816C43140; Thu, 13 Oct 2022 17:56:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665683820; bh=CK8zW69mYsVe631d9uSwXr4sBV2nDL15Y8aevweb+n8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mngPvIZLNidfc/yUF1Qo87PG8nOSaXyIHfXQDP+2DOmwn6rSTtgt0FyUKwlalzCsd cBFBtYHUGlK2u9NNXjw6rsox1KE0IgA1slnB42g8xlNBPibdQAlRjl0D1BXz52Ngfz 4y+4RvDCSA7WsDNEB77FpvvA85mW6zq3cWXoXuHA= From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, =?utf-8?q?S=C3=B6nke_Huster?= <shuster@seemoo.tu-darmstadt.de>, Johannes Berg <johannes.berg@intel.com> Subject: [PATCH 5.10 47/54] wifi: cfg80211: avoid nontransmitted BSS list corruption Date: Thu, 13 Oct 2022 19:52:41 +0200 Message-Id: <20221013175148.476986632@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221013175147.337501757@linuxfoundation.org> References: <20221013175147.337501757@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746596356732888329?= X-GMAIL-MSGID: =?utf-8?q?1746596356732888329?= |
Series |
None
|
|
Commit Message
Greg KH
Oct. 13, 2022, 5:52 p.m. UTC
From: Johannes Berg <johannes.berg@intel.com> commit bcca852027e5878aec911a347407ecc88d6fff7f upstream. If a non-transmitted BSS shares enough information (both SSID and BSSID!) with another non-transmitted BSS of a different AP, then we can find and update it, and then try to add it to the non-transmitted BSS list. We do a search for it on the transmitted BSS, but if it's not there (but belongs to another transmitted BSS), the list gets corrupted. Since this is an erroneous situation, simply fail the list insertion in this case and free the non-transmitted BSS. This fixes CVE-2022-42721. Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de> Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de> Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/wireless/scan.c | 9 +++++++++ 1 file changed, 9 insertions(+)
--- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -425,6 +425,15 @@ cfg80211_add_nontrans_list(struct cfg802 rcu_read_unlock(); + /* + * This is a bit weird - it's not on the list, but already on another + * one! The only way that could happen is if there's some BSSID/SSID + * shared by multiple APs in their multi-BSSID profiles, potentially + * with hidden SSID mixed in ... ignore it. + */ + if (!list_empty(&nontrans_bss->nontrans_list)) + return -EINVAL; + /* add to the list */ list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list); return 0;