netdev - Re: [PATCH 5.4/5.10 1/1] mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 23 Feb 2023 10:11:39 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Fedor Pchelkin <pchelkin@...ras.ru>
Cc:     stable@...r.kernel.org, Johannes Berg <johannes@...solutions.net>,
        Pavel Skripkin <paskripkin@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Bob Copeland <me@...copeland.com>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Alexey Khoroshilov <khoroshilov@...ras.ru>,
        lvc-project@...uxtesting.org,
        syzbot+860268315ba86ea6b96b@...kaller.appspotmail.com,
        Johannes Berg <johannes.berg@...el.com>
Subject: Re: [PATCH 5.4/5.10 1/1] mac80211: mesh: embedd mesh_paths and
 mpp_paths into ieee80211_if_mesh

On Wed, Feb 22, 2023 at 11:03:01PM +0300, Fedor Pchelkin wrote:
> From: Pavel Skripkin <paskripkin@...il.com>
> 
> commit 8b5cb7e41d9d77ffca036b0239177de123394a55 upstream.
> 
> Syzbot hit NULL deref in rhashtable_free_and_destroy(). The problem was
> in mesh_paths and mpp_paths being NULL.
> 
> mesh_pathtbl_init() could fail in case of memory allocation failure, but
> nobody cared, since ieee80211_mesh_init_sdata() returns void. It led to
> leaving 2 pointers as NULL. Syzbot has found null deref on exit path,
> but it could happen anywhere else, because code assumes these pointers are
> valid.
> 
> Since all ieee80211_*_setup_sdata functions are void and do not fail,
> let's embedd mesh_paths and mpp_paths into parent struct to avoid
> adding error handling on higher levels and follow the pattern of others
> setup_sdata functions
> 
> Fixes: 60854fd94573 ("mac80211: mesh: convert path table to rhashtable")
> Reported-and-tested-by: syzbot+860268315ba86ea6b96b@...kaller.appspotmail.com
> Signed-off-by: Pavel Skripkin <paskripkin@...il.com>
> Link: https://lore.kernel.org/r/20211230195547.23977-1-paskripkin@gmail.com
> Signed-off-by: Johannes Berg <johannes.berg@...el.com>
> [pchelkin@...ras.ru: adapt a comment spell fixing issue]
> Signed-off-by: Fedor Pchelkin <pchelkin@...ras.ru>
> ---

This also worked for 4.19.y, but not 4.14.y, care to also fix it there?

thanks,

greg k-h