Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b8fff407 authored by Johannes Berg's avatar Johannes Berg
Browse files

mac80211: fix use-after-free in defragmentation 



Upon receiving the last fragment, all but the first fragment
are freed, but the multicast check for statistics at the end
of the function refers to the current skb (the last fragment)
causing a use-after-free bug.

Since multicast frames cannot be fragmented and we check for
this early in the function, just modify that check to also
do the accounting to fix the issue.

Cc: stable@vger.kernel.org
Reported-by: default avatarYosef Khyal <yosefx.khyal@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 46238845

net/mac80211/rx.c

+7 −7
Original line number Diff line number Diff line
@@ -1678,11 +1678,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) 
	sc = le16_to_cpu(hdr->seq_ctrl);

	frag = sc & IEEE80211_SCTL_FRAG;



	if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||

		   is_multicast_ether_addr(hdr->addr1))) {

		/* not fragmented */

	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))

		goto out;



	if (is_multicast_ether_addr(hdr->addr1)) {

		rx->local->dot11MulticastReceivedFrameCount++;

		goto out;

	}



	I802_DEBUG_INC(rx->local->rx_handlers_fragments);



	if (skb_linearize(rx->skb))
@@ -1775,9 +1778,6 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) 
 out:

	if (rx->sta)

		rx->sta->rx_packets++;

	if (is_multicast_ether_addr(hdr->addr1))

		rx->local->dot11MulticastReceivedFrameCount++;

	else

	ieee80211_led_rx(rx->local);

	return RX_CONTINUE;

}