In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: fix tid_tx use-after-free on BA session stop<\/p>\n
ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() through
\nieee80211_remove_tid_tx(), and then reads tid_tx->ndp after dropping
\nsta->lock:<\/p>\n
\tieee80211_remove_tid_tx(sta, tid);\t\/* kfree_rcu(tid_tx, rcu_head) *\/
\n\t…
\n\tspin_unlock_bh(&sta->lock);<\/p>\n
\tif (start_txq)
\n\t\tieee80211_agg_start_txq(sta, tid, false);<\/p>\n
\tif (send_delba)
\n\t\tieee80211_send_delba(…, tid_tx->ndp);<\/p>\n
That read is not covered by an RCU read-side critical section, and it runs
\nin preemptible process context: both callers hold the wiphy mutex, reaching
\nit either from the ieee80211_ba_session_work() wiphy work or from
\nieee80211_sta_tear_down_BA_sessions() during station teardown.
\nSoftirqs can run in that window too, both from the local_bh_enable() that
\nends ieee80211_agg_start_txq() and from any interrupt exit, so the RCU
\ncallback can free tid_tx before the read.<\/p>\n
Driving the function from a test module with the grace period forced into
\nthat window, KASAN reports the read, and the free arrives on the ordinary
\nRCU softirq path:<\/p>\n
BUG: KASAN: slab-use-after-free in ieee80211_stop_tx_ba_cb+0x3cd\/0x400
\n Read of size 1 at addr ffff888002b9f52e by task kworker\/0:1\/10
\n […]
\n Freed by task 57:
\n __kasan_slab_free+0x47\/0x70
\n __rcu_free_sheaf_prepare+0x70\/0x250
\n rcu_free_sheaf_nobarn+0x18\/0x40
\n rcu_core+0x426\/0x1310
\n handle_softirqs+0x144\/0x590
\n __irq_exit_rcu+0xea\/0x150
\n irq_exit_rcu+0x9\/0x20
\n sysvec_apic_timer_interrupt+0x6b\/0x80
\n asm_sysvec_apic_timer_interrupt+0x1a\/0x20<\/p>\n
send_delba is only set when tx_stop is set, which happens for
\nAGG_STOP_LOCAL_REQUEST alone, so this is reached on local teardown –
\nsession idle timeout, PTK rekey, suspend, HW reconfig – and not from a
\npeer’s DELBA.<\/p>\n
Read ndp into a local before the session is freed, while sta->lock is still
\nheld. tid_tx->ndp has a single writer, in
\nieee80211_tx_ba_session_handle_start(), which cannot run concurrently here:
\nboth paths are serialised by the wiphy mutex, and the session is already
\nmarked HT_AGG_STATE_STOPPING at this point. tid_tx->ndp is also the only
\ntid_tx dereference left after ieee80211_remove_tid_tx() in this function.<\/p>\n
[move\/change the comment a bit to be more general not just on ndp,
\n initialize ndp directly]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: mac80211: fix tid_tx use-after-free on BA session stop<\/p>\n
ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() through
\nieee802<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7482","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7482","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7482"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7482"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7482"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}