cfg80211: call cfg80211_leave_ocb when switching away from OCB
authorDu Cheng <ducheng2@gmail.com>
Wed, 28 Apr 2021 06:39:41 +0000 (14:39 +0800)
committerJohannes Berg <johannes.berg@intel.com>
Mon, 31 May 2021 19:27:15 +0000 (21:27 +0200)
commita64b6a25dd9f984ed05fade603a00e2eae787d2f
treeff7606a303e54c1d119b0c4890fe1d2076f759f9
parent34fb4db5abc1fe6708522cbf13f637e0eefb1a50
cfg80211: call cfg80211_leave_ocb when switching away from OCB

If the userland switches back-and-forth between NL80211_IFTYPE_OCB and
NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), there is a
chance where the cleanup cfg80211_leave_ocb() is not called. This leads
to initialization of in-use memory (e.g. init u.ibss while in-use by
u.ocb) due to a shared struct/union within ieee80211_sub_if_data:

struct ieee80211_sub_if_data {
    ...
    union {
        struct ieee80211_if_ap ap;
        struct ieee80211_if_vlan vlan;
        struct ieee80211_if_managed mgd;
        struct ieee80211_if_ibss ibss; // <- shares address
        struct ieee80211_if_mesh mesh;
        struct ieee80211_if_ocb ocb; // <- shares address
        struct ieee80211_if_mntr mntr;
        struct ieee80211_if_nan nan;
    } u;
    ...
}

Therefore add handling of otype == NL80211_IFTYPE_OCB, during
cfg80211_change_iface() to perform cleanup when leaving OCB mode.

link to syzkaller bug:
https://syzkaller.appspot.com/bug?id=0612dbfa595bf4b9b680ff7b4948257b8e3732d5

Reported-by: syzbot+105896fac213f26056f9@syzkaller.appspotmail.com
Signed-off-by: Du Cheng <ducheng2@gmail.com>
Link: https://lore.kernel.org/r/20210428063941.105161-1-ducheng2@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/wireless/util.c