2019-11-13 11:09:21

by Sergey Matyukevich

Subject: [PATCH 1/7] qtnfmac: fix using skb after free

KASAN reported use-after-free error:

[ 995.220767] BUG: KASAN: use-after-free in qtnf_cmd_send_with_reply+0x169/0x3e0 [qtnfmac]
[ 995.221098] Read of size 2 at addr ffff888213d1ded0 by task kworker/1:1/71

The issue in qtnf_cmd_send_with_reply impacts all the commands that do
not need response other then return code. For such commands, consume_skb
is used for response skb and right after that return code in response
skb is accessed.

Signed-off-by: Sergey Matyukevich <[email protected]>
---
drivers/net/wireless/quantenna/qtnfmac/commands.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c
index dc0c7244b60e..c0c32805fb8d 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/commands.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c
@@ -83,6 +83,7 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus,
struct qlink_cmd *cmd;
struct qlink_resp *resp = NULL;
struct sk_buff *resp_skb = NULL;
+ int resp_res = 0;
u16 cmd_id;
u8 mac_id;
u8 vif_id;
@@ -113,6 +114,7 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus,
}

resp = (struct qlink_resp *)resp_skb->data;
+ resp_res = le16_to_cpu(resp->result);
ret = qtnf_cmd_check_reply_header(resp, cmd_id, mac_id, vif_id,
const_resp_size);
if (ret)
@@ -128,8 +130,8 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus,
else
consume_skb(resp_skb);

- if (!ret && resp)
- return qtnf_cmd_resp_result_decode(le16_to_cpu(resp->result));
+ if (!ret)
+ return qtnf_cmd_resp_result_decode(resp_res);

pr_warn("VIF%u.%u: cmd 0x%.4X failed: %d\n",
mac_id, vif_id, cmd_id, ret);
--
2.11.0

2019-11-14 15:32:33

by Kalle Valo

Subject: Re: [PATCH 1/7] qtnfmac: fix using skb after free

Sergey Matyukevich <[email protected]> wrote:

> KASAN reported use-after-free error:
>
> [ 995.220767] BUG: KASAN: use-after-free in qtnf_cmd_send_with_reply+0x169/0x3e0 [qtnfmac]
> [ 995.221098] Read of size 2 at addr ffff888213d1ded0 by task kworker/1:1/71
>
> The issue in qtnf_cmd_send_with_reply impacts all the commands that do
> not need response other then return code. For such commands, consume_skb
> is used for response skb and right after that return code in response
> skb is accessed.
>
> Signed-off-by: Sergey Matyukevich <[email protected]>

7 patches applied to wireless-drivers-next.git, thanks.

4a33f21cef84 qtnfmac: fix using skb after free
dd4c2260dab0 qtnfmac: fix debugfs support for multiple cards
24227a9e956a qtnfmac: fix invalid channel information output
97aef03cb71b qtnfmac: modify Rx descriptors queue setup
46d55fcec163 qtnfmac: send EAPOL frames via control path
239ce8a79778 qtnfmac: handle MIC failure event from firmware
0756e913fc02 qtnfmac: add support for getting/setting transmit power

--
https://patchwork.kernel.org/patch/11241691/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches