From bf487c0089c936fada89fd35129fc61e91e6fdf5 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 20 Mar 2012 08:44:32 -0400 Subject: [PATCH] mac80211: fix possible tid_rx->reorder_timer use after free from Stanislaw Gruska (rhbz 804007) --- kernel.spec | 12 +++++- ...-tid_rx-reorder_timer-use-after-free.patch | 42 +++++++++++++++++++ 2 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch diff --git a/kernel.spec b/kernel.spec index fd5f6075c..b8014c175 100644 --- a/kernel.spec +++ b/kernel.spec @@ -42,7 +42,7 @@ Summary: The Linux kernel # When changing real_sublevel below, reset this by hand to 1 # (or to 0 and then use rpmdev-bumpspec). # -%global baserelease 4 +%global baserelease 5 %global fedora_build %{baserelease} # real_sublevel is the 3.x kernel version we're starting with @@ -724,6 +724,9 @@ Patch21110: x86-ioapic-add-register-checks-for-bogus-io-apic-entries.patch Patch21200: unhandled-irqs-switch-to-polling.patch +#rhbz 804007 +Patch21305: mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch + Patch22000: weird-root-dentry-name-debug.patch %endif @@ -1334,6 +1337,9 @@ ApplyPatch ACPICA-Fix-regression-in-FADT-revision-checks.patch #rhbz 728478 ApplyPatch sony-laptop-Enable-keyboard-backlight-by-default.patch +#rhbz 804007 +ApplyPatch mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch + ApplyPatch unhandled-irqs-switch-to-polling.patch ApplyPatch weird-root-dentry-name-debug.patch @@ -1990,6 +1996,10 @@ fi # and build. %changelog +* Tue Mar 20 2012 Josh Boyer +- mac80211: fix possible tid_rx->reorder_timer use after free + from Stanislaw Gruska (rhbz 804007) + * Fri Mar 16 2012 Justin M. Forbes - re-enable threading on hibernate compression/decompression diff --git a/mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch b/mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch new file mode 100644 index 000000000..accda8afc --- /dev/null +++ b/mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch @@ -0,0 +1,42 @@ +Is possible that we will arm the tid_rx->reorder_timer after +del_timer_sync() in ___ieee80211_stop_rx_ba_session(). We need to stop +timer after RCU grace period finish, so move it to +ieee80211_free_tid_rx(). Timer will not be armed again, as +rcu_dereference(sta->ampdu_mlme.tid_rx[tid]) will return NULL. + +Debug object detected problem with the following warning: +ODEBUG: free active (active state 0) object type: timer_list hint: sta_rx_agg_reorder_timer_expired+0x0/0xf0 [mac80211] + +Bug report (with all warning messages): +https://bugzilla.redhat.com/show_bug.cgi?id=804007 + +Reported-by: "jan p. springer" +Cc: stable@vger.kernel.org +Signed-off-by: Stanislaw Gruszka +--- + net/mac80211/agg-rx.c | 3 ++- + 1 files changed, 2 insertions(+), 1 deletions(-) + +diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c +index 1068f66..64d3ce5 100644 +--- a/net/mac80211/agg-rx.c ++++ b/net/mac80211/agg-rx.c +@@ -49,6 +49,8 @@ static void ieee80211_free_tid_rx(struct rcu_head *h) + container_of(h, struct tid_ampdu_rx, rcu_head); + int i; + ++ del_timer_sync(&tid_rx->reorder_timer); ++ + for (i = 0; i < tid_rx->buf_size; i++) + dev_kfree_skb(tid_rx->reorder_buf[i]); + kfree(tid_rx->reorder_buf); +@@ -91,7 +93,6 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid, + tid, WLAN_BACK_RECIPIENT, reason); + + del_timer_sync(&tid_rx->session_timer); +- del_timer_sync(&tid_rx->reorder_timer); + + call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx); + } +-- +1.7.1