linux-stable/net
Johannes Berg 265bec4779 wifi: mac80211: fix use-after-free in chanctx code
commit 2965c4cdf7 upstream.

In ieee80211_vif_use_reserved_context(), when we have an
old context and the new context's replace_state is set to
IEEE80211_CHANCTX_REPLACE_NONE, we free the old context
in ieee80211_vif_use_reserved_reassign(). Therefore, we
cannot check the old_ctx anymore, so we should set it to
NULL after this point.

However, since the new_ctx replace state is clearly not
IEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do
anything else in this function and can just return to
avoid accessing the freed old_ctx.

Cc: stable@vger.kernel.org
Fixes: 5bcae31d9c ("mac80211: implement multi-vif in-place reservations")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220601091926.df419d91b165.I17a9b3894ff0b8323ce2afdb153b101124c821e5@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-14 18:11:44 +02:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-09-15 09:47:31 +02:00
9p xen/9p: use alloc/free_pages_exact() 2022-03-11 11:22:39 +01:00
802 net/802/garp: fix memleak in garp_request_join() 2021-07-31 08:19:38 +02:00
8021q net: vlan: fix underflow for the real_dev refcnt 2021-12-01 09:23:34 +01:00
appletalk appletalk: Fix skb allocation size in loopback case 2021-04-07 14:47:41 +02:00
atm
ax25 ax25: Fix UAF bugs in ax25 timers 2022-04-20 09:19:40 +02:00
batman-adv batman-adv: Don't skb_split skbuffs with frag_list 2022-05-18 09:47:24 +02:00
bluetooth Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout 2022-06-14 18:11:37 +02:00
bpf
bpfilter bpfilter: Specify the log level for the kmsg message 2021-07-14 16:53:33 +02:00
bridge net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. 2022-05-25 09:14:36 +02:00
caif net-caif: avoid user-triggerable WARN_ON(1) 2021-09-22 12:26:40 +02:00
can can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM 2021-12-08 09:01:08 +01:00
ceph
core bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes 2022-06-06 08:33:51 +02:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-08 19:07:51 +01:00
dccp tcp: fix race condition when creating child sockets from syncookies 2022-04-27 13:50:45 +02:00
decnet net: decnet: Fix sleeping inside in af_decnet 2021-07-28 13:30:56 +02:00
dns_resolver
dsa net: dsa: Add missing of_node_put() in dsa_port_parse_of 2022-03-23 09:12:07 +01:00
ethernet
hsr hsr: use netdev_err() instead of WARN_ONCE() 2021-05-14 09:44:10 +02:00
ieee802154 net: ieee802154: Return meaningful error codes from the netlink helpers 2022-02-08 18:24:31 +01:00
ife
ipv4 secure_seq: use the 64 bits of the siphash for port offset calculation 2022-06-06 08:33:49 +02:00
ipv6 ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL 2022-06-14 18:11:27 +02:00
iucv net/af_iucv: remove WARN_ONCE on malformed RX packets 2021-03-07 12:20:42 +01:00
kcm
key net: af_key: check encryption module availability consistency 2022-06-06 08:33:49 +02:00
l2tp net/l2tp: Fix reference count leak in l2tp_udp_recv_core 2021-09-22 12:26:41 +02:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-27 13:50:47 +02:00
lapb net: lapb: Copy the skb before sending a packet 2021-02-10 09:25:28 +01:00
llc llc: only change llc->dev when bind() succeeds 2022-03-28 08:46:48 +02:00
mac80211 wifi: mac80211: fix use-after-free in chanctx code 2022-06-14 18:11:44 +02:00
mac802154 net: mac802154: Fix general protection fault 2021-04-14 08:24:18 +02:00
mpls net: mpls: Fix notifications when deleting a device 2021-12-08 09:01:12 +01:00
ncsi net/ncsi: check for error return from call to nla_put_u32 2022-01-05 12:37:45 +01:00
netfilter netfilter: nft_socket: only do sk lookups when indev is available 2022-05-09 09:03:27 +02:00
netlabel netlabel: fix out-of-bounds memory accesses 2022-04-15 14:18:35 +02:00
netlink netlink: do not reset transport header in netlink_recvmsg() 2022-05-18 09:47:25 +02:00
netrom netrom: Decrease sock refcount when sock timers expire 2021-07-28 13:30:56 +02:00
nfc NFC: NULL out the dev->rfkill to prevent UAF 2022-06-14 18:11:33 +02:00
nsh
openvswitch openvswitch: fix OOB access in reserve_sfa_size() 2022-04-27 13:50:49 +02:00
packet net/packet: fix packet_sock xmit return value checking 2022-04-27 13:50:47 +02:00
phonet phonet: refcount leak in pep_sock_accep 2022-01-11 15:23:33 +01:00
psample
qrtr net: qrtr: fix another OOB Read in qrtr_endpoint_post 2021-09-03 10:08:12 +02:00
rds rds: memory leak in __rds_conn_create() 2021-12-22 09:29:37 +01:00
rfkill rfkill: Fix use-after-free in rfkill_resume() 2020-11-24 13:29:05 +01:00
rose rose: Fix Null pointer dereference in rose_send_frame() 2020-12-08 10:40:23 +01:00
rxrpc rxrpc: Fix decision on when to generate an IDLE ACK 2022-06-14 18:11:38 +02:00
sched net/sched: act_pedit: sanitize shift argument before usage 2022-05-25 09:14:35 +02:00
sctp sctp: read sk->sk_bound_dev_if once in sctp_rcv() 2022-06-14 18:11:37 +02:00
smc net/smc: postpone sk_refcnt increment in connect() 2022-06-14 18:11:39 +02:00
strparser bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-17 09:48:48 +01:00
sunrpc SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() 2022-05-25 09:14:34 +02:00
switchdev net: switchdev: do not propagate bridge updates across bridges 2021-10-27 09:54:24 +02:00
tipc tipc: fix the timer expires after interval 100ms 2022-04-15 14:18:17 +02:00
tls tls: Skip tls_append_frag on zero copy size 2022-05-09 09:03:26 +02:00
unix af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress 2022-01-27 09:19:53 +01:00
vmw_vsock vsock: remove vsock from connected table when connect is interrupted by a signal 2022-02-23 11:59:57 +01:00
wimax
wireless nl80211: show SSID for P2P_GO interfaces 2022-06-14 18:11:32 +02:00
x25 net/x25: Fix null-ptr-deref caused by x25_disconnect 2022-04-15 14:18:21 +02:00
xdp Revert "xsk: Do not sleep in poll() when need_wakeup set" 2021-12-22 09:29:40 +01:00
xfrm xfrm: fix tunnel model fragmentation behavior 2022-04-15 14:17:56 +02:00
compat.c net: Return the correct errno code 2021-06-18 09:59:00 +02:00
Kconfig
Makefile
socket.c net: don't unconditionally copy_from_user a struct ifreq for socket ioctls 2021-09-03 10:08:16 +02:00
sysctl_net.c