From: Greg Kroah-Hartman Date: Mon, 9 Jan 2017 08:42:00 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v4.4.42~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6791c8ecbff67ad416208441fe34ee9833582905;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: mac80211-initialize-fast-xmit-info-later.patch --- diff --git a/queue-4.4/mac80211-initialize-fast-xmit-info-later.patch b/queue-4.4/mac80211-initialize-fast-xmit-info-later.patch new file mode 100644 index 00000000000..02375271fbe --- /dev/null +++ b/queue-4.4/mac80211-initialize-fast-xmit-info-later.patch @@ -0,0 +1,46 @@ +From 35f432a03e41d3bf08c51ede917f94e2288fbe8c Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 2 Jan 2017 11:19:29 +0100 +Subject: mac80211: initialize fast-xmit 'info' later + +From: Johannes Berg + +commit 35f432a03e41d3bf08c51ede917f94e2288fbe8c upstream. + +In ieee80211_xmit_fast(), 'info' is initialized to point to the skb +that's passed in, but that skb may later be replaced by a clone (if +it was shared), leading to an invalid pointer. + +This can lead to use-after-free and also later crashes since the +real SKB's info->hw_queue doesn't get initialized properly. + +Fix this by assigning info only later, when it's needed, after the +skb replacement (may have) happened. + +Reported-by: Ben Greear +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/tx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -2699,7 +2699,7 @@ static bool ieee80211_xmit_fast(struct i + int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2); + int hw_headroom = sdata->local->hw.extra_tx_headroom; + struct ethhdr eth; +- struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); ++ struct ieee80211_tx_info *info; + struct ieee80211_hdr *hdr = (void *)fast_tx->hdr; + struct ieee80211_tx_data tx; + ieee80211_tx_result r; +@@ -2761,6 +2761,7 @@ static bool ieee80211_xmit_fast(struct i + memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN); + memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN); + ++ info = IEEE80211_SKB_CB(skb); + memset(info, 0, sizeof(*info)); + info->band = fast_tx->band; + info->control.vif = &sdata->vif; diff --git a/queue-4.4/series b/queue-4.4/series index 88a7a45df8e..37211ad4a8d 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -2,3 +2,4 @@ alsa-hda-fix-up-gpio-for-asus-rog-ranger.patch alsa-hda-apply-asus-mode8-fixup-to-asus-x71sl.patch alsa-usb-audio-fix-irq-process-data-synchronization.patch arm-davinci-da850-don-t-add-emac-clock-to-lookup-table-twice.patch +mac80211-initialize-fast-xmit-info-later.patch