Commit 788211d8 authored by Johannes Berg's avatar Johannes Berg

mac80211: fix RX A-MPDU session reorder timer deletion

There's an issue with the way the RX A-MPDU reorder timer is
deleted that can cause a kernel crash like this:

 * tid_rx is removed - call_rcu(ieee80211_free_tid_rx)
 * station is destroyed
 * reorder timer fires before ieee80211_free_tid_rx() runs,
   accessing the station, thus potentially crashing due to
   the use-after-free

The station deletion is protected by synchronize_net(), but
that isn't enough -- ieee80211_free_tid_rx() need not have
run when that returns (it deletes the timer.) We could use
rcu_barrier() instead of synchronize_net(), but that's much
more expensive.

Instead, to fix this, add a field tracking that the session
is being deleted. In this case, the only re-arming of the
timer happens with the reorder spinlock held, so make that
code not rearm it if the session is being deleted and also
delete the timer after setting that field. This ensures the
timer cannot fire after ___ieee80211_stop_rx_ba_session()
returns, which fixes the problem.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent f84eaa10
...@@ -49,8 +49,6 @@ static void ieee80211_free_tid_rx(struct rcu_head *h) ...@@ -49,8 +49,6 @@ static void ieee80211_free_tid_rx(struct rcu_head *h)
container_of(h, struct tid_ampdu_rx, rcu_head); container_of(h, struct tid_ampdu_rx, rcu_head);
int i; int i;
del_timer_sync(&tid_rx->reorder_timer);
for (i = 0; i < tid_rx->buf_size; i++) for (i = 0; i < tid_rx->buf_size; i++)
__skb_queue_purge(&tid_rx->reorder_buf[i]); __skb_queue_purge(&tid_rx->reorder_buf[i]);
kfree(tid_rx->reorder_buf); kfree(tid_rx->reorder_buf);
...@@ -93,6 +91,12 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid, ...@@ -93,6 +91,12 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
del_timer_sync(&tid_rx->session_timer); del_timer_sync(&tid_rx->session_timer);
/* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
spin_lock_bh(&tid_rx->reorder_lock);
tid_rx->removed = true;
spin_unlock_bh(&tid_rx->reorder_lock);
del_timer_sync(&tid_rx->reorder_timer);
call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx); call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
} }
......
...@@ -873,9 +873,10 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata, ...@@ -873,9 +873,10 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
set_release_timer: set_release_timer:
mod_timer(&tid_agg_rx->reorder_timer, if (!tid_agg_rx->removed)
tid_agg_rx->reorder_time[j] + 1 + mod_timer(&tid_agg_rx->reorder_timer,
HT_RX_REORDER_BUF_TIMEOUT); tid_agg_rx->reorder_time[j] + 1 +
HT_RX_REORDER_BUF_TIMEOUT);
} else { } else {
del_timer(&tid_agg_rx->reorder_timer); del_timer(&tid_agg_rx->reorder_timer);
} }
......
...@@ -175,6 +175,7 @@ struct tid_ampdu_tx { ...@@ -175,6 +175,7 @@ struct tid_ampdu_tx {
* @reorder_lock: serializes access to reorder buffer, see below. * @reorder_lock: serializes access to reorder buffer, see below.
* @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and * @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and
* and ssn. * and ssn.
* @removed: this session is removed (but might have been found due to RCU)
* *
* This structure's lifetime is managed by RCU, assignments to * This structure's lifetime is managed by RCU, assignments to
* the array holding it must hold the aggregation mutex. * the array holding it must hold the aggregation mutex.
...@@ -199,6 +200,7 @@ struct tid_ampdu_rx { ...@@ -199,6 +200,7 @@ struct tid_ampdu_rx {
u16 timeout; u16 timeout;
u8 dialog_token; u8 dialog_token;
bool auto_seq; bool auto_seq;
bool removed;
}; };
/** /**
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment