[RFC,v5.10,0/3] mac80211 use-after-free fix

Message ID	20221014164150.24310-1-johannes@sipsolutions.net
Headers	show Return-Path: <linux-wireless-owner@kernel.org> From: Johannes Berg <johannes@sipsolutions.net> To: linux-wireless@vger.kernel.org, stable@vger.kernel.org Cc: Felix Fietkau <nbd@nbd.name>, Thadeu Lima de Souza Cascardo <cascardo@canonical.com>, Marcus Meissner <meissner@suse.de>, Jiri Kosina <jkosina@suse.de> Subject: [RFC v5.10 0/3] mac80211 use-after-free fix Date: Fri, 14 Oct 2022 18:41:47 +0200 Message-Id: <20221014164150.24310-1-johannes@sipsolutions.net> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	mac80211 use-after-free fix \| expand [RFC,v5.10,0/3] mac80211 use-after-free fix [RFC,v5.10,1/3] mac80211: mlme: find auth challenge directly [RFC,v5.10,2/3] wifi: mac80211: don't parse mbssid in assoc response [RFC,v5.10,3/3] wifi: mac80211: fix MBSSID parsing use-after-free

Message ID

20221014164150.24310-1-johannes@sipsolutions.net

Headers

From: Johannes Berg <johannes@sipsolutions.net>
To: linux-wireless@vger.kernel.org, stable@vger.kernel.org
Cc: Felix Fietkau <nbd@nbd.name>,
        Thadeu Lima de Souza Cascardo <cascardo@canonical.com>,
        Marcus Meissner <meissner@suse.de>,
        Jiri Kosina <jkosina@suse.de>
Subject: [RFC v5.10 0/3] mac80211 use-after-free fix
Date: Fri, 14 Oct 2022 18:41:47 +0200
Message-Id: <20221014164150.24310-1-johannes@sipsolutions.net>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

mac80211 use-after-free fix | expand

Message

Johannes Berg Oct. 14, 2022, 4:41 p.m. UTC

Hi,

So I looked at this, and it wasn't great one way or the other...

The first patch here is obvious, let's just take it and get one
of the parsings out of the way.

The second one removes a couple of more cases where this is done,
since it only happens when the last argument is non-NULL.

The third then is to avoid the UAF, and is simpler now since only
a few places can even allocate it.

johannes