Siddh Raman Pant <code@xxxxxxxx> writes: > ieee80211_scan_rx() tries to access scan_req->flags after a null check > (see line 303 of mac80211/scan.c), but ___cfg80211_scan_done() uses > kfree() on the scan_req (see line 991 of wireless/scan.c). > > This results in a UAF. > > ieee80211_scan_rx() is called inside a RCU read-critical section > initiated by ieee80211_rx_napi() (see line 5043 of mac80211/rx.c). > > Thus, add an rcu_head to the scan_req struct so as to use kfree_rcu() > instead of kfree() so that we don't free during the critical section. > > Bug report (3): https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d > Reported-by: syzbot+f9acff9bf08a845f225d@xxxxxxxxxxxxxxxxxxxxxxxxx > Reported-by: syzbot+6cb476b7c69916a0caca@xxxxxxxxxxxxxxxxxxxxxxxxx > Reported-by: syzbot+9250865a55539d384347@xxxxxxxxxxxxxxxxxxxxxxxxx > > Signed-off-by: Siddh Raman Pant <code@xxxxxxxx> > --- > include/net/cfg80211.h | 2 ++ > net/wireless/scan.c | 2 +- > 2 files changed, 3 insertions(+), 1 deletion(-) The title should be: wifi: cfg80211: Fix UAF in ieee80211_scan_rx() -- https://patchwork.kernel.org/project/linux-wireless/list/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
