linux-kernel - [PATCH] carl9170: main: fix an incorrect use of list iterator

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 27 Mar 2022 15:27:02 +0800
From:   Xiaomeng Tong <xiam0nd.tong@...il.com>
To:     chunkeey@...glemail.com
Cc:     kvalo@...nel.org, davem@...emloft.net, kuba@...nel.org,
        pabeni@...hat.com, linville@...driver.com,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Xiaomeng Tong <xiam0nd.tong@...il.com>, stable@...r.kernel.org
Subject: [PATCH] carl9170: main: fix an incorrect use of list iterator

The bug is here:
	rcu_assign_pointer(ar->tx_ampdu_iter,
		(struct carl9170_sta_tid *) &ar->tx_ampdu_list);

The 'ar->tx_ampdu_iter' is used as a list iterator variable
which point to a structure object containing the list HEAD
(&ar->tx_ampdu_list), not as the HEAD itself.

The only use case of 'ar->tx_ampdu_iter' is as a base pos
for list_for_each_entry_continue_rcu in carl9170_tx_ampdu().
If the iterator variable holds the *wrong* HEAD value here
(has not been modified elsewhere before), this will lead to
an invalid memory access.

Using list_entry_rcu to get the right list iterator variable
and reassign it, to fix this bug.
Note: use 'ar->tx_ampdu_list.next' instead of '&ar->tx_ampdu_list'
to avoid compiler error.

Cc: stable@...r.kernel.org
Fixes: fe8ee9ad80b28 ("carl9170: mac80211 glue and command interface")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@...il.com>
---
 drivers/net/wireless/ath/carl9170/main.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 49f7ee1c912b..a287937bf666 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1756,6 +1756,7 @@ static const struct ieee80211_ops carl9170_ops = {
 
 void *carl9170_alloc(size_t priv_size)
 {
+	struct carl9170_sta_tid *tid_info;
 	struct ieee80211_hw *hw;
 	struct ar9170 *ar;
 	struct sk_buff *skb;
@@ -1815,8 +1816,9 @@ void *carl9170_alloc(size_t priv_size)
 	INIT_DELAYED_WORK(&ar->stat_work, carl9170_stat_work);
 	INIT_DELAYED_WORK(&ar->tx_janitor, carl9170_tx_janitor);
 	INIT_LIST_HEAD(&ar->tx_ampdu_list);
-	rcu_assign_pointer(ar->tx_ampdu_iter,
-			   (struct carl9170_sta_tid *) &ar->tx_ampdu_list);
+	tid_info = list_entry_rcu(ar->tx_ampdu_list.next,
+				struct carl9170_sta_tid, list);
+	rcu_assign_pointer(ar->tx_ampdu_iter, tid_info);
 
 	bitmap_zero(&ar->vif_bitmap, ar->fw.vif_num);
 	INIT_LIST_HEAD(&ar->vif_list);
-- 
2.17.1