]> git.baikalelectronics.ru Git - kernel.git/commit
mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
authorPavel Skripkin <paskripkin@gmail.com>
Thu, 30 Dec 2021 19:55:47 +0000 (22:55 +0300)
committerJohannes Berg <johannes.berg@intel.com>
Tue, 4 Jan 2022 14:11:49 +0000 (15:11 +0100)
commit3744db4c759825ee5d87c82c8f20a1d6d22a2a8b
tree15c951e2a01fb183d595c874f35f0c4e2ef226f2
parentcfb80dde657ce196f5151f7f1b7b03a28cf4fc2e
mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh

Syzbot hit NULL deref in rhashtable_free_and_destroy(). The problem was
in mesh_paths and mpp_paths being NULL.

mesh_pathtbl_init() could fail in case of memory allocation failure, but
nobody cared, since ieee80211_mesh_init_sdata() returns void. It led to
leaving 2 pointers as NULL. Syzbot has found null deref on exit path,
but it could happen anywhere else, because code assumes these pointers are
valid.

Since all ieee80211_*_setup_sdata functions are void and do not fail,
let's embedd mesh_paths and mpp_paths into parent struct to avoid
adding error handling on higher levels and follow the pattern of others
setup_sdata functions

Fixes: 0ef9e26daa10 ("mac80211: mesh: convert path table to rhashtable")
Reported-and-tested-by: syzbot+860268315ba86ea6b96b@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/20211230195547.23977-1-paskripkin@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/mac80211/ieee80211_i.h
net/mac80211/mesh.h
net/mac80211/mesh_pathtbl.c