Yu Zhao 1db5852945 cfg80211: fix use-after-free in reg_process_hint() ... reg_process_hint_country_ie() can free regulatory_request and return REG_REQ_ALREADY_SET. We shouldn't use regulatory_request after it's called. KASAN error was observed when this happens. BUG: KASAN: use-after-free in reg_process_hint+0x839/0x8aa [cfg80211] Read of size 4 at addr ffff8800c430d434 by task kworker/1:3/89 <snipped> Workqueue: events reg_todo [cfg80211] Call Trace: dump_stack+0xc1/0x10c ? _atomic_dec_and_lock+0x1ad/0x1ad ? _raw_spin_lock_irqsave+0xa0/0xd2 print_address_description+0x86/0x26f ? reg_process_hint+0x839/0x8aa [cfg80211] kasan_report+0x241/0x29b reg_process_hint+0x839/0x8aa [cfg80211] reg_todo+0x204/0x5b9 [cfg80211] process_one_work+0x55f/0x8d0 ? worker_detach_from_pool+0x1b5/0x1b5 ? _raw_spin_unlock_irq+0x65/0xdd ? _raw_spin_unlock_irqrestore+0xf3/0xf3 worker_thread+0x5dd/0x841 ? kthread_parkme+0x1d/0x1d kthread+0x270/0x285 ? pr_cont_work+0xe3/0xe3 ? rcu_read_unlock_sched_notrace+0xca/0xca ret_from_fork+0x22/0x40 Allocated by task 2718: set_track+0x63/0xfa __kmalloc+0x119/0x1ac regulatory_hint_country_ie+0x38/0x329 [cfg80211] __cfg80211_connect_result+0x854/0xadd [cfg80211] cfg80211_rx_assoc_resp+0x3bc/0x4f0 [cfg80211] smsc95xx v1.0.6 ieee80211_sta_rx_queued_mgmt+0x1803/0x7ed5 [mac80211] ieee80211_iface_work+0x411/0x696 [mac80211] process_one_work+0x55f/0x8d0 worker_thread+0x5dd/0x841 kthread+0x270/0x285 ret_from_fork+0x22/0x40 Freed by task 89: set_track+0x63/0xfa kasan_slab_free+0x6a/0x87 kfree+0xdc/0x470 reg_process_hint+0x31e/0x8aa [cfg80211] reg_todo+0x204/0x5b9 [cfg80211] process_one_work+0x55f/0x8d0 worker_thread+0x5dd/0x841 kthread+0x270/0x285 ret_from_fork+0x22/0x40 <snipped> Signed-off-by: Yu Zhao <yuzhao@google.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>		2018-10-01 09:14:03 +02:00
..
certs
.gitignore
ap.c	nl80211: Add SOCKET_OWNER support to START_AP	2018-03-29 10:47:28 +02:00
chan.c	cfg80211: enable use of non-cleared DFS channels for DFS offload	2018-03-29 10:21:35 +02:00
core.c	This round's updates:	2018-06-30 21:08:12 +09:00
core.h	cfg80211: track time using boottime	2018-06-29 09:49:28 +02:00
debugfs.c
debugfs.h
ethtool.c
ibss.c	nl80211: Add SOCKET_OWNER support to JOIN_IBSS	2018-03-29 10:36:22 +02:00
Kconfig
lib80211_crypt_ccmp.c
lib80211_crypt_tkip.c	wireless/lib80211: Convert from ahash to shash	2018-07-24 09:17:20 +02:00
lib80211_crypt_wep.c
lib80211.c
Makefile
mesh.c	nl80211: Add SOCKET_OWNER support to JOIN_MESH	2018-03-29 10:38:24 +02:00
mlme.c
nl80211.c	nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds	2018-09-27 11:44:44 +02:00
nl80211.h
ocb.c
of.c
radiotap.c
rdev-ops.h	cfg80211: Expose TXQ stats and parameters to userspace	2018-05-08 13:19:24 +02:00
reg.c	cfg80211: fix use-after-free in reg_process_hint()	2018-10-01 09:14:03 +02:00
reg.h
scan.c	cfg80211: Address some corner cases in scan result channel updating	2018-09-10 09:13:09 +02:00
sme.c	nl80211: add FILS related parameters to ROAM event	2018-05-23 11:19:02 +02:00
sysfs.c	cfg80211: track time using boottime	2018-06-29 09:49:28 +02:00
sysfs.h
trace.c
trace.h	nl80211/mac80211: allow non-linear skb in rx_control_port	2018-07-06 14:34:42 +02:00
util.c	Here are quite a large number of fixes, notably:	2018-09-03 22:12:02 -07:00
wext-compat.c	cfg80211: fix wext-compat memory leak	2018-10-01 09:11:36 +02:00
wext-compat.h
wext-core.c	net: Don't take rtnl_lock() in wireless_nlevent_flush()	2018-03-29 13:47:53 -04:00
wext-priv.c
wext-proc.c	proc: introduce proc_create_net{,_data}	2018-05-16 07:24:30 +02:00
wext-sme.c
wext-spy.c