Checks are presently in place in validate_nla() to ensure strings
greater than 2 are not passed in by the user which could potentially
cause issues.
However, there is nothing to prevent userspace from only providing a
single (1) Byte as the data length parameter via nla_put(). If this
were to happen, it would cause an OOB read in regulatory_hint_user(),
since it makes assumptions that alpha2[0] and alpha2[1] will always be
accessible.
Add an additional check, to ensure enough data has been allocated to
hold both Bytes.
Cc: <stable(a)vger.kernel.org>
Cc: Johannes Berg <johannes(a)sipsolutions.net>
Cc: "David S. Miller" <davem(a)davemloft.net>
Cc: Jakub Kicinski <kuba(a)kernel.org>
Cc: Paolo Abeni <pabeni(a)redhat.com>
Cc: linux-wireless(a)vger.kernel.org
Cc: netdev(a)vger.kernel.org
Signed-off-by: Lee Jones <lee.jones(a)linaro.org>
---
net/wireless/nl80211.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index ee1c2b6b69711..80a516033db36 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -7536,6 +7536,10 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
return -EINVAL;
+ if (nla_len(info->attrs[NL80211_ATTR_REG_ALPHA2]) !=
+ nl80211_policy[NL80211_ATTR_REG_ALPHA2].len)
+ return -EINVAL;
+
data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
return regulatory_hint_user(data, user_reg_hint_type);
case NL80211_USER_REG_HINT_INDOOR:
--
2.35.1.1094.g7c7d902a7c-goog
From: Lin Ma <linma(a)zju.edu.cn>
commit 0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 upstream.
There is a possible race condition (use-after-free) like below
(USE) | (FREE)
dev_queue_xmit |
__dev_queue_xmit |
__dev_xmit_skb |
sch_direct_xmit | ...
xmit_one |
netdev_start_xmit | tty_ldisc_kill
__netdev_start_xmit | 6pack_close
sp_xmit | kfree
sp_encaps |
|
According to the patch "defer ax25 kfree after unregister_netdev", this
patch reorder the kfree after the unregister_netdev to avoid the possible
UAF as the unregister_netdev() is well synchronized and won't return if
there is a running routine.
Signed-off-by: Lin Ma <linma(a)zju.edu.cn>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Xu Jia <xujia39(a)huawei.com>
---
drivers/net/hamradio/6pack.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 02d6f3a..82507a6 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -679,9 +679,11 @@ static void sixpack_close(struct tty_struct *tty)
del_timer_sync(&sp->tx_t);
del_timer_sync(&sp->resync_t);
- /* Free all 6pack frame buffers. */
+ /* Free all 6pack frame buffers after unreg. */
kfree(sp->rbuff);
kfree(sp->xbuff);
+
+ free_netdev(sp->dev);
}
/* Perform I/O control on an active 6pack channel. */
--
1.8.3.1