• Johannes Berg's avatar
    mac80211: fix use-after-free · cd87a2d3
    Johannes Berg authored
    commit 8c0c709e
    Author: Johannes Berg <johannes@sipsolutions.net>
    Date:   Wed Nov 25 17:46:15 2009 +0100
    
        mac80211: move cmntr flag out of rx flags
    
    moved the CMTR flag into the skb's status, and
    in doing so introduced a use-after-free -- when
    the skb has been handed to cooked monitors the
    status setting will touch now invalid memory.
    
    Additionally, moving it there has effectively
    discarded the optimisation -- since the bit is
    only ever set on freed SKBs, and those were a
    copy, it could never be checked.
    
    For the current release, fixing this properly
    is a bit too involved, so let's just remove the
    problematic code and leave userspace with one
    copy of each frame for each virtual interface.
    
    Cc: stable@kernel.org [2.6.33+]
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
    cd87a2d3
rx.c 73.3 KB