mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-06 02:50:43 +00:00
mac80211: validate skb->dev in the tx status path
skb->dev might contain a stale reference to a device that was already deleted, and using it unchecked can lead to invalid pointer accesses. Since this is only used for nl80211 tx, iterate over active interfaces to find a match for skb->dev, and discard the tx status if the device is gone. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
parent
b22cfcfcae
commit
1bad538243
1 changed files with 30 additions and 18 deletions
|
@ -517,29 +517,41 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
|
|||
|
||||
if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
|
||||
u64 cookie = (unsigned long)skb;
|
||||
bool found = false;
|
||||
|
||||
acked = info->flags & IEEE80211_TX_STAT_ACK;
|
||||
|
||||
if (ieee80211_is_nullfunc(hdr->frame_control) ||
|
||||
ieee80211_is_qos_nullfunc(hdr->frame_control)) {
|
||||
cfg80211_probe_status(skb->dev, hdr->addr1,
|
||||
cookie, acked, GFP_ATOMIC);
|
||||
} else if (skb->dev) {
|
||||
cfg80211_mgmt_tx_status(
|
||||
skb->dev->ieee80211_ptr, cookie, skb->data,
|
||||
skb->len, acked, GFP_ATOMIC);
|
||||
} else {
|
||||
struct ieee80211_sub_if_data *p2p_sdata;
|
||||
rcu_read_lock();
|
||||
|
||||
rcu_read_lock();
|
||||
list_for_each_entry_rcu(sdata, &local->interfaces, list) {
|
||||
if (!sdata->dev)
|
||||
continue;
|
||||
|
||||
p2p_sdata = rcu_dereference(local->p2p_sdata);
|
||||
if (p2p_sdata) {
|
||||
cfg80211_mgmt_tx_status(
|
||||
&p2p_sdata->wdev, cookie, skb->data,
|
||||
skb->len, acked, GFP_ATOMIC);
|
||||
}
|
||||
rcu_read_unlock();
|
||||
if (skb->dev != sdata->dev)
|
||||
continue;
|
||||
|
||||
found = true;
|
||||
break;
|
||||
}
|
||||
|
||||
if (!skb->dev) {
|
||||
sdata = rcu_dereference(local->p2p_sdata);
|
||||
if (sdata)
|
||||
found = true;
|
||||
}
|
||||
|
||||
if (!found)
|
||||
skb->dev = NULL;
|
||||
else if (ieee80211_is_nullfunc(hdr->frame_control) ||
|
||||
ieee80211_is_qos_nullfunc(hdr->frame_control)) {
|
||||
cfg80211_probe_status(sdata->dev, hdr->addr1,
|
||||
cookie, acked, GFP_ATOMIC);
|
||||
} else {
|
||||
cfg80211_mgmt_tx_status(&sdata->wdev, cookie, skb->data,
|
||||
skb->len, acked, GFP_ATOMIC);
|
||||
}
|
||||
|
||||
rcu_read_unlock();
|
||||
}
|
||||
|
||||
if (unlikely(info->ack_frame_id)) {
|
||||
|
|
Loading…
Reference in a new issue