In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mac802154: fix use-after-free of sdata via queued RX frames<\/p>\n
The RX softirq producer ieee802154_subif_frame() queues received beacon
\nand MAC-command frames onto local->rx_beacon_list \/ rx_mac_cmd_list and
\nschedules a process-context worker, storing a raw mac_pkt->sdata (and
\nskb->dev == sdata->dev) with neither a reference nor any locking:<\/p>\n
– the lists have no lock: the softirq producer list_add_tail()s while the
\n mac_wq worker list_del()s, so sibling interfaces on the same phy corrupt
\n the list;<\/p>\n
– the workers dereference the interface after it may have been freed.
\n mac802154_rx_mac_cmd_worker() touches mac_pkt->sdata directly, and
\n mac802154_rx_beacon_worker() -> mac802154_process_beacon() dereferences
\n skb->dev (== sdata->dev). Removing an interface frees its sdata
\n (netdev_priv) while a queued frame still points at it, so a later worker
\n run is a use-after-free.<\/p>\n
Reproduced under KASAN by flooding a victim interface with MAC command
\nframes and removing it (the beacon path is the same class via skb->dev):<\/p>\n
BUG: KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker+0x463\/0x630 [mac802154]
\n Read of size 4 at addr ffff888002f9ea18 by task kworker\/u8:1\/31
\n Workqueue: phy0-mac-cmds mac802154_rx_mac_cmd_worker [mac802154]
\n Call Trace:
\n mac802154_rx_mac_cmd_worker+0x463\/0x630 [mac802154]
\n process_one_work+0x611\/0xe80
\n worker_thread+0x52e\/0xdc0
\n kthread+0x30c\/0x630
\n ret_from_fork+0x2fd\/0x3e0<\/p>\n
Fix both lists together:<\/p>\n
– add local->rx_lock and take it around every list access: the softirq
\n producer (plain spin_lock, softirq context) and the workers and flush
\n (spin_lock_bh, process context);<\/p>\n
– pin the interface for the lifetime of a queued frame with
\n netdev_hold()\/netdev_put(), so the worker can safely dereference sdata \/
\n skb->dev even while the interface is being removed;<\/p>\n
– dequeue under the lock at the head and loop-drain the whole list in the
\n workers (they previously processed one frame per run and relied on a
\n later enqueue to drain the rest);<\/p>\n
– drop not-yet-started frames of an interface before it is unregistered,
\n from ieee802154_if_remove() (after the RCU grace period) and from the
\n ieee802154_remove_interfaces() loop — the latter is the whole-phy
\n teardown path, which does not go through ieee802154_if_remove().<\/p>\n
An in-flight worker that already dequeued a frame keeps its own netdev
\nreference; unregister_netdevice() then waits it out in netdev_run_todo(),
\nwhich runs at rtnl_unlock() (rtnl released) and after the interface has
\nbeen closed, so it does not pin rtnl. A worker blocked in an association
\nTX only delays that one interface’s unregister (the usual “waiting for %s
\nto become free”), it does not hold rtnl. netdev_hold() is used for this
\nreason instead of a cancel_work_sync() under rtnl, which would block on
\nthe worker’s unbounded MLME TX wait via ieee802154_sync_queue().<\/p>\n
The mac-command worker additionally skips processing for a stopped
\ninterface (ieee802154_sdata_running()), avoiding a needless association
\nresponse during teardown.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mac802154: fix use-after-free of sdata via queued RX frames<\/p>\n
The RX softirq producer ieee802154_subif_frame() queues received beaco<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29027","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29027","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29027"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29027"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29027"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}