Patch "cfg80211: call cfg80211_leave_ocb when switching away from OCB" has been added to the 5.12-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    cfg80211: call cfg80211_leave_ocb when switching away from OCB

to the 5.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     cfg80211-call-cfg80211_leave_ocb-when-switching-away.patch
and it can be found in the queue-5.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 5bd56516c81e70fb46d7d24e526fab68895b714c
Author: Du Cheng <ducheng2@xxxxxxxxx>
Date:   Wed Apr 28 14:39:41 2021 +0800

    cfg80211: call cfg80211_leave_ocb when switching away from OCB
    
    [ Upstream commit a64b6a25dd9f984ed05fade603a00e2eae787d2f ]
    
    If the userland switches back-and-forth between NL80211_IFTYPE_OCB and
    NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), there is a
    chance where the cleanup cfg80211_leave_ocb() is not called. This leads
    to initialization of in-use memory (e.g. init u.ibss while in-use by
    u.ocb) due to a shared struct/union within ieee80211_sub_if_data:
    
    struct ieee80211_sub_if_data {
        ...
        union {
            struct ieee80211_if_ap ap;
            struct ieee80211_if_vlan vlan;
            struct ieee80211_if_managed mgd;
            struct ieee80211_if_ibss ibss; // <- shares address
            struct ieee80211_if_mesh mesh;
            struct ieee80211_if_ocb ocb; // <- shares address
            struct ieee80211_if_mntr mntr;
            struct ieee80211_if_nan nan;
        } u;
        ...
    }
    
    Therefore add handling of otype == NL80211_IFTYPE_OCB, during
    cfg80211_change_iface() to perform cleanup when leaving OCB mode.
    
    link to syzkaller bug:
    https://syzkaller.appspot.com/bug?id=0612dbfa595bf4b9b680ff7b4948257b8e3732d5
    
    Reported-by: syzbot+105896fac213f26056f9@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Du Cheng <ducheng2@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20210428063941.105161-1-ducheng2@xxxxxxxxx
    Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/wireless/util.c b/net/wireless/util.c
index f342b6147675..726e7d2342bd 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1059,6 +1059,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
 		case NL80211_IFTYPE_MESH_POINT:
 			/* mesh should be handled? */
 			break;
+		case NL80211_IFTYPE_OCB:
+			cfg80211_leave_ocb(rdev, dev);
+			break;
 		default:
 			break;
 		}