In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver<\/p>\n
ieee80211_set_bitrate_mask() checks if the interface is running via
\nieee80211_sdata_running(), but it does not check if the interface is
\nstill present in the driver.<\/p>\n
When sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the
\ncall reaches drv_set_bitrate_mask() in driver-ops.h which hits<\/p>\n
wlan1: Failed check-sdata-in-driver check, flags: 0x0
\n WARNING: net\/mac80211\/driver-ops.h:884 at drv_set_bitrate_mask<\/p>\n
Syzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows
\nwext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling
\nioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate()
\nin wext-compat.c. That builds a bitrate mask and calls
\nrdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in
\ncfg.c. The interface is marked running via SDATA_STATE_RUNNING but
\nflags is 0, so check_sdata_in_driver() fails.<\/p>\n
When the interface is being torn down, or when wext ioctl is issued
\nduring interface bringup before drv_add_interface() sets IN_DRIVER, the
\nrunning check passes while IN_DRIVER is clear.<\/p>\n
Check IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before
\ncalling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in
\ndriver-ops.h and matches other cfg.c operations that bail early when not
\nin driver.<\/p>\n
This change should be safe because wiphy mutex is held in
\ncfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set\/cleared
\nunder RTNL and wiphy paths in drv_add_interface() and
\ndrv_remove_interface() in driver-ops.c, so the check is race-free
\nagainst driver add\/remove. Returning -ENETDOWN is the same error other
\nnot-running paths use and does not introduce new locking.<\/p>\n
[also add second syzbot report]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver<\/p>\n
ieee80211_set_bitrate_mask() checks if the interface is ru<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-39077","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/39077","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=39077"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=39077"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=39077"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}