linux-wireless.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* Double 'put' of bss in mac80211/mlme.c?
@ 2013-06-14 23:34 Ben Greear
  2013-06-14 23:38 ` Ben Greear
  0 siblings, 1 reply; 2+ messages in thread
From: Ben Greear @ 2013-06-14 23:34 UTC (permalink / raw)
  To: linux-wireless@vger.kernel.org

Looks like an easy way to leak ies would be to mess up the
ref counting on bss objects.

While looking at such code, I found this in mac80211/mlme.c

The destroy_assoc_data does a put_bss, and then it is put again
directly.  Is this on purpose, or would this effectively cause
a double-free?

		if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
			/* oops -- internal error -- send timeout for now */
			ieee80211_destroy_assoc_data(sdata, false);
			cfg80211_put_bss(sdata->local->hw.wiphy, *bss);
			return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
		}

Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: Double 'put' of bss in mac80211/mlme.c?
  2013-06-14 23:34 Double 'put' of bss in mac80211/mlme.c? Ben Greear
@ 2013-06-14 23:38 ` Ben Greear
  0 siblings, 0 replies; 2+ messages in thread
From: Ben Greear @ 2013-06-14 23:38 UTC (permalink / raw)
  To: linux-wireless@vger.kernel.org

On 06/14/2013 04:34 PM, Ben Greear wrote:
> Looks like an easy way to leak ies would be to mess up the
> ref counting on bss objects.
>
> While looking at such code, I found this in mac80211/mlme.c
>
> The destroy_assoc_data does a put_bss, and then it is put again
> directly.  Is this on purpose, or would this effectively cause
> a double-free?
>
>          if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
>              /* oops -- internal error -- send timeout for now */
>              ieee80211_destroy_assoc_data(sdata, false);
>              cfg80211_put_bss(sdata->local->hw.wiphy, *bss);
>              return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
>          }
>
> Thanks,
> Ben
>

Gah, nevermind...one is assoc_data->bss, the other is auth_data->bss.

Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2013-06-14 23:38 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-06-14 23:34 Double 'put' of bss in mac80211/mlme.c? Ben Greear
2013-06-14 23:38 ` Ben Greear

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).