diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2010-09-24 11:20:47 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-10-28 21:51:21 -0700 |
| commit | 22d59a19e77a8b8c2d1b83fc98272cc095ac92b7 (patch) | |
| tree | 04ce269cf37ccf609cdc19d26c9ed9f6db7a27c4 /net | |
| parent | b6df308f73dee36d4c1810ede94068a78455c485 (diff) | |
mac80211: fix use-after-free
commit cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963 upstream.
commit 8c0c709eea5cbab97fb464cd68b06f24acc58ee1
Author: Johannes Berg <johannes@sipsolutions.net>
Date: Wed Nov 25 17:46:15 2009 +0100
mac80211: move cmntr flag out of rx flags
moved the CMTR flag into the skb's status, and
in doing so introduced a use-after-free -- when
the skb has been handed to cooked monitors the
status setting will touch now invalid memory.
Additionally, moving it there has effectively
discarded the optimisation -- since the bit is
only ever set on freed SKBs, and those were a
copy, it could never be checked.
For the current release, fixing this properly
is a bit too involved, so let's just remove the
problematic code and leave userspace with one
copy of each frame for each virtual interface.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mac80211/rx.c | 4 |
1 files changed, 0 insertions, 4 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index be9abc2e634..af775e9bf60 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -2156,9 +2156,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, struct net_device *prev_dev = NULL; struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); - if (status->flag & RX_FLAG_INTERNAL_CMTR) - goto out_free_skb; - if (skb_headroom(skb) < sizeof(*rthdr) && pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC)) goto out_free_skb; @@ -2217,7 +2214,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, } else goto out_free_skb; - status->flag |= RX_FLAG_INTERNAL_CMTR; return; out_free_skb: |