Commit bc11c708 authored by Johannes Berg's avatar Johannes Berg Committed by Ben Hutchings

mac80211: fix use-after-free in defragmentation

commit b8fff407 upstream.

Upon receiving the last fragment, all but the first fragment
are freed, but the multicast check for statistics at the end
of the function refers to the current skb (the last fragment)
causing a use-after-free bug.

Since multicast frames cannot be fragmented and we check for
this early in the function, just modify that check to also
do the accounting to fix the issue.
Reported-by: default avatarYosef Khyal <yosefx.khyal@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
parent 7ce77510
...@@ -1470,11 +1470,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) ...@@ -1470,11 +1470,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
sc = le16_to_cpu(hdr->seq_ctrl); sc = le16_to_cpu(hdr->seq_ctrl);
frag = sc & IEEE80211_SCTL_FRAG; frag = sc & IEEE80211_SCTL_FRAG;
if (likely((!ieee80211_has_morefrags(fc) && frag == 0) || if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
is_multicast_ether_addr(hdr->addr1))) { goto out;
/* not fragmented */
if (is_multicast_ether_addr(hdr->addr1)) {
rx->local->dot11MulticastReceivedFrameCount++;
goto out; goto out;
} }
I802_DEBUG_INC(rx->local->rx_handlers_fragments); I802_DEBUG_INC(rx->local->rx_handlers_fragments);
if (skb_linearize(rx->skb)) if (skb_linearize(rx->skb))
...@@ -1567,10 +1570,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) ...@@ -1567,10 +1570,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
out: out:
if (rx->sta) if (rx->sta)
rx->sta->rx_packets++; rx->sta->rx_packets++;
if (is_multicast_ether_addr(hdr->addr1)) ieee80211_led_rx(rx->local);
rx->local->dot11MulticastReceivedFrameCount++;
else
ieee80211_led_rx(rx->local);
return RX_CONTINUE; return RX_CONTINUE;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment