This is a note to let you know that I've just added the patch titled mac80211: fix memory leaks with element parsing to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: mac80211-fix-memory-leaks-with-element-parsing.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Fri Oct 14 10:18:27 AM CEST 2022 From: Felix Fietkau <nbd@xxxxxxxx> Date: Thu, 13 Oct 2022 20:16:00 +0200 Subject: mac80211: fix memory leaks with element parsing To: stable@xxxxxxxxxxxxxxx Cc: johannes@xxxxxxxxxxxxxxxx Message-ID: <20221013181601.5712-5-nbd@xxxxxxxx> From: Johannes Berg <johannes.berg@xxxxxxxxx> commit 8223ac199a3849257e86ec27865dc63f034b1cf1 upstream. My previous commit 5d24828d05f3 ("mac80211: always allocate struct ieee802_11_elems") had a few bugs and leaked the new allocated struct in a few error cases, fix that. Fixes: 5d24828d05f3 ("mac80211: always allocate struct ieee802_11_elems") Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx> Link: https://lore.kernel.org/r/20211001211108.9839928e42e0.Ib81ca187d3d3af7ed1bfeac2e00d08a4637c8025@changeid Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx> Cc: Felix Fietkau <nbd@xxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/mac80211/agg-rx.c | 3 ++- net/mac80211/ibss.c | 10 +++++----- net/mac80211/mlme.c | 38 +++++++++++++++++++------------------- 3 files changed, 26 insertions(+), 25 deletions(-) --- a/net/mac80211/agg-rx.c +++ b/net/mac80211/agg-rx.c @@ -499,13 +499,14 @@ void ieee80211_process_addba_request(str elems = ieee802_11_parse_elems(mgmt->u.action.u.addba_req.variable, ies_len, true, mgmt->bssid, NULL); if (!elems || elems->parse_error) - return; + goto free; } __ieee80211_start_rx_ba_session(sta, dialog_token, timeout, start_seq_num, ba_policy, tid, buf_size, true, false, elems ? elems->addba_ext_ie : NULL); +free: kfree(elems); } --- a/net/mac80211/ibss.c +++ b/net/mac80211/ibss.c @@ -1663,11 +1663,11 @@ void ieee80211_ibss_rx_queued_mgmt(struc mgmt->u.action.u.chan_switch.variable, ies_len, true, mgmt->bssid, NULL); - if (!elems || elems->parse_error) - break; - - ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt, skb->len, - rx_status, elems); + if (elems && !elems->parse_error) + ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt, + skb->len, + rx_status, + elems); kfree(elems); break; } --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -3374,8 +3374,10 @@ static bool ieee80211_assoc_success(stru bss_ies = kmemdup(ies, sizeof(*ies) + ies->len, GFP_ATOMIC); rcu_read_unlock(); - if (!bss_ies) - return false; + if (!bss_ies) { + ret = false; + goto out; + } bss_elems = ieee802_11_parse_elems(bss_ies->data, bss_ies->len, false, mgmt->bssid, @@ -4358,13 +4360,11 @@ void ieee80211_sta_rx_queued_mgmt(struct mgmt->u.action.u.chan_switch.variable, ies_len, true, mgmt->bssid, NULL); - if (!elems || elems->parse_error) - break; - - ieee80211_sta_process_chanswitch(sdata, - rx_status->mactime, - rx_status->device_timestamp, - elems, false); + if (elems && !elems->parse_error) + ieee80211_sta_process_chanswitch(sdata, + rx_status->mactime, + rx_status->device_timestamp, + elems, false); kfree(elems); } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) { struct ieee802_11_elems *elems; @@ -4384,17 +4384,17 @@ void ieee80211_sta_rx_queued_mgmt(struct mgmt->u.action.u.ext_chan_switch.variable, ies_len, true, mgmt->bssid, NULL); - if (!elems || elems->parse_error) - break; + if (elems && !elems->parse_error) { + /* for the handling code pretend it was an IE */ + elems->ext_chansw_ie = + &mgmt->u.action.u.ext_chan_switch.data; + + ieee80211_sta_process_chanswitch(sdata, + rx_status->mactime, + rx_status->device_timestamp, + elems, false); + } - /* for the handling code pretend this was also an IE */ - elems->ext_chansw_ie = - &mgmt->u.action.u.ext_chan_switch.data; - - ieee80211_sta_process_chanswitch(sdata, - rx_status->mactime, - rx_status->device_timestamp, - elems, false); kfree(elems); } break; Patches currently in stable-queue which might be from nbd@xxxxxxxx are queue-5.15/mac80211-fix-memory-leaks-with-element-parsing.patch queue-5.15/mac80211-mlme-find-auth-challenge-directly.patch queue-5.15/mac80211-mesh-clean-up-rx_bcn_presp-api.patch queue-5.15/wifi-mac80211-fix-mbssid-parsing-use-after-free.patch queue-5.15/mac80211-always-allocate-struct-ieee802_11_elems.patch queue-5.15/mac80211-move-crc-into-struct-ieee802_11_elems.patch