malhuda/msm-4.14
1
0
Fork 0
mirror of https://github.com/rd-stuffs/msm-4.14.git synced 2025-02-20 11:45:48 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

mac80211: validate skb->dev in the tx status path

Browse Source 
skb->dev might contain a stale reference to a device that was already
deleted, and using it unchecked can lead to invalid pointer accesses.
Since this is only used for nl80211 tx, iterate over active interfaces
to find a match for skb->dev, and discard the tx status if the device
is gone.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Felix Fietkau 2012-09-08 11:58:30 +02:00 committed by Johannes Berg
parent b22cfcfcae
commit 1bad538243
1 changed files with 30 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
net/mac80211/status.c
View File

@ -517,29 +517,41 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) { if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
u64 cookie = (unsigned long)skb; u64 cookie = (unsigned long)skb;
bool found = false;
acked = info->flags & IEEE80211_TX_STAT_ACK; acked = info->flags & IEEE80211_TX_STAT_ACK;
if (ieee80211_is_nullfunc(hdr->frame_control) || rcu_read_lock();
ieee80211_is_qos_nullfunc(hdr->frame_control)) {
cfg80211_probe_status(skb->dev, hdr->addr1,
cookie, acked, GFP_ATOMIC);
} else if (skb->dev) {
cfg80211_mgmt_tx_status(
skb->dev->ieee80211_ptr, cookie, skb->data,
skb->len, acked, GFP_ATOMIC);
} else {
struct ieee80211_sub_if_data *p2p_sdata;
rcu_read_lock(); list_for_each_entry_rcu(sdata, &local->interfaces, list) {
if (!sdata->dev)
continue;
p2p_sdata = rcu_dereference(local->p2p_sdata); if (skb->dev != sdata->dev)
if (p2p_sdata) { continue;
cfg80211_mgmt_tx_status(
&p2p_sdata->wdev, cookie, skb->data, found = true;
skb->len, acked, GFP_ATOMIC); break;
}
rcu_read_unlock();
} }
if (!skb->dev) {
sdata = rcu_dereference(local->p2p_sdata);
if (sdata)
found = true;
}
if (!found)
skb->dev = NULL;
else if (ieee80211_is_nullfunc(hdr->frame_control) ||
ieee80211_is_qos_nullfunc(hdr->frame_control)) {
cfg80211_probe_status(sdata->dev, hdr->addr1,
cookie, acked, GFP_ATOMIC);
} else {
cfg80211_mgmt_tx_status(&sdata->wdev, cookie, skb->data,
skb->len, acked, GFP_ATOMIC);
}
rcu_read_unlock();
} }
if (unlikely(info->ack_frame_id)) { if (unlikely(info->ack_frame_id)) {