If the userland switches back-and-forth between NL80211_IFTYPE_OCB and
NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), there is a
chance where the cleanup cfg80211_leave_ocb() is not called. This leads
to initialization of in-use memory (e.g. init u.ibss while in-use by
u.ocb) due to a shared struct/union within ieee80211_sub_if_data:
struct ieee80211_sub_if_data {
...
union {
struct ieee80211_if_ap ap;
struct ieee80211_if_vlan vlan;
struct ieee80211_if_managed mgd;
struct ieee80211_if_ibss ibss; // <- shares address
struct ieee80211_if_mesh mesh;
struct ieee80211_if_ocb ocb; // <- shares address
struct ieee80211_if_mntr mntr;
struct ieee80211_if_nan nan;
} u;
...
}
Therefore add handling of otype == NL80211_IFTYPE_OCB, during
cfg80211_change_iface() to perform cleanup when leaving OCB mode.
link to syzkaller bug:
https://syzkaller.appspot.com/bug?id=0612dbfa595bf4b9b680ff7b4948257b8e3732d5
Reported-by: syzbot+105896fac213f26056f9@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Du Cheng <ducheng2@xxxxxxxxx>
---
Reproducible steps:
1. NL80211_CMD_SET_INTERFACE: NL80211_IFTYPE_ADHOC
// set IBSS mode
2. NL80211_CMD_SET_INTERFACE: NL80211_IFTYPE_OCB
// switch to OCB mode, calls ieee80211_ocb_setup_sdata, init u.ocb.housekeeping_timer
3. NL80211_CMD_JOIN_OCB
4. NL80211_CMD_SET_INTERFACE: NL80211_IFTYPE_ADHOC
// swtich to IBSS mode without calling NL80211_CMD_LEAVE_OCB,
// leaving u.ocb.housekeeping_timer NOT destroyed
5. entering IBSS mode, kernel panic while initializing u.ibss.timer, an active
debug_object as &u.ibss.timer == &u.ocb.housekeeping_timer
net/wireless/util.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 1bf0200f562a..f424ac7633bb 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1056,6 +1056,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
case NL80211_IFTYPE_MESH_POINT:
/* mesh should be handled? */
break;
+ case NL80211_IFTYPE_OCB:
+ cfg80211_leave_ocb(rdev, dev);
+ break;
default:
break;
}
--
2.30.2
