Patch "wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach" has been added to the 6.7-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach

to the 6.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_cfg802.patch
and it can be found in the queue-6.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1065aaeac4dc43ce1105a07d882ab16315d5b4d1
Author: Zheng Wang <zyytlz.wz@xxxxxxx>
Date:   Sun Jan 7 08:25:04 2024 +0100

    wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
    
    [ Upstream commit 0f7352557a35ab7888bc7831411ec8a3cbe20d78 ]
    
    This is the candidate patch of CVE-2023-47233 :
    https://nvd.nist.gov/vuln/detail/CVE-2023-47233
    
    In brcm80211 driver,it starts with the following invoking chain
    to start init a timeout worker:
    
    ->brcmf_usb_probe
      ->brcmf_usb_probe_cb
        ->brcmf_attach
          ->brcmf_bus_started
            ->brcmf_cfg80211_attach
              ->wl_init_priv
                ->brcmf_init_escan
                  ->INIT_WORK(&cfg->escan_timeout_work,
                      brcmf_cfg80211_escan_timeout_worker);
    
    If we disconnect the USB by hotplug, it will call
    brcmf_usb_disconnect to make cleanup. The invoking chain is :
    
    brcmf_usb_disconnect
      ->brcmf_usb_disconnect_cb
        ->brcmf_detach
          ->brcmf_cfg80211_detach
            ->kfree(cfg);
    
    While the timeout woker may still be running. This will cause
    a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.
    
    Fix it by deleting the timer and canceling the worker in
    brcmf_cfg80211_detach.
    
    Fixes: e756af5b30b0 ("brcmfmac: add e-scan support.")
    Signed-off-by: Zheng Wang <zyytlz.wz@xxxxxxx>
    Cc: stable@xxxxxxxxxxxxxxx
    [arend.vanspriel@xxxxxxxxxxxx: keep timer delete as is and cancel work just before free]
    Signed-off-by: Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx>
    Signed-off-by: Kalle Valo <kvalo@xxxxxxxxxx>
    Link: https://msgid.link/20240107072504.392713-1-arend.vanspriel@xxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 8facd40d713e6..fdc0852bdcddb 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -1179,8 +1179,7 @@ s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 	scan_request = cfg->scan_request;
 	cfg->scan_request = NULL;
 
-	if (timer_pending(&cfg->escan_timeout))
-		del_timer_sync(&cfg->escan_timeout);
+	timer_delete_sync(&cfg->escan_timeout);
 
 	if (fw_abort) {
 		/* Do a scan abort to stop the driver's scan engine */
@@ -8440,6 +8439,7 @@ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
 	brcmf_btcoex_detach(cfg);
 	wiphy_unregister(cfg->wiphy);
 	wl_deinit_priv(cfg);
+	cancel_work_sync(&cfg->escan_timeout_work);
 	brcmf_free_wiphy(cfg->wiphy);
 	kfree(cfg);
 }




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux