Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Du Cheng <ducheng2@gmail.com>
To:     Johannes Berg <johannes@sipsolutions.net>
Cc:     linux-wireless@vger.kernel.org,
        Shuah Khan <skhan@linuxfoundation.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Du Cheng <ducheng2@gmail.com>,
        syzbot+105896fac213f26056f9@syzkaller.appspotmail.com
Subject: [PATCH] net:wireless: call cfg80211_leave_ocb when switching between ADHOC and OCB
Date:   Wed, 28 Apr 2021 14:39:41 +0800
Message-Id: <20210428063941.105161-1-ducheng2@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

If the userland switches back-and-forth between NL80211_IFTYPE_OCB and
NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), there is a
chance where the cleanup cfg80211_leave_ocb() is not called. This leads
to initialization of in-use memory (e.g. init u.ibss while in-use by
u.ocb) due to a shared struct/union within ieee80211_sub_if_data:

struct ieee80211_sub_if_data {
    ...
    union {
        struct ieee80211_if_ap ap;
        struct ieee80211_if_vlan vlan;
        struct ieee80211_if_managed mgd;
        struct ieee80211_if_ibss ibss; // <- shares address
        struct ieee80211_if_mesh mesh;
        struct ieee80211_if_ocb ocb; // <- shares address
        struct ieee80211_if_mntr mntr;
        struct ieee80211_if_nan nan;
    } u;
    ...
}

Therefore add handling of otype == NL80211_IFTYPE_OCB, during
cfg80211_change_iface() to perform cleanup when leaving OCB mode.

link to syzkaller bug:
https://syzkaller.appspot.com/bug?id=0612dbfa595bf4b9b680ff7b4948257b8e3732d5

Reported-by: syzbot+105896fac213f26056f9@syzkaller.appspotmail.com
Signed-off-by: Du Cheng <ducheng2@gmail.com>
---
Reproducible steps:

1. NL80211_CMD_SET_INTERFACE: NL80211_IFTYPE_ADHOC
// set IBSS mode

2. NL80211_CMD_SET_INTERFACE: NL80211_IFTYPE_OCB 
// switch to OCB mode, calls ieee80211_ocb_setup_sdata, init u.ocb.housekeeping_timer

3. NL80211_CMD_JOIN_OCB

4. NL80211_CMD_SET_INTERFACE: NL80211_IFTYPE_ADHOC
// swtich to IBSS mode without calling NL80211_CMD_LEAVE_OCB,
// leaving u.ocb.housekeeping_timer NOT destroyed

5. entering IBSS mode, kernel panic while initializing u.ibss.timer, an active
debug_object as &u.ibss.timer == &u.ocb.housekeeping_timer


 net/wireless/util.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/wireless/util.c b/net/wireless/util.c
index 1bf0200f562a..f424ac7633bb 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1056,6 +1056,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
 		case NL80211_IFTYPE_MESH_POINT:
 			/* mesh should be handled? */
 			break;
+		case NL80211_IFTYPE_OCB:
+			cfg80211_leave_ocb(rdev, dev);
+			break;
 		default:
 			break;
 		}
-- 
2.30.2