git.openwrt.org Git - openwrt/staging/adrian.git/blob

   1 From 8460e3230988ef2ec13ce6b69b687e941f6cdb32 Mon Sep 17 00:00:00 2001
   2 From: Jouni Malinen <jouni@codeaurora.org>
   3 Date: Tue, 8 Dec 2020 23:52:50 +0200
   4 Subject: [PATCH] P2P: Fix a corner case in peer addition based on PD Request
   5
   6 p2p_add_device() may remove the oldest entry if there is no room in the
   7 peer table for a new peer. This would result in any pointer to that
   8 removed entry becoming stale. A corner case with an invalid PD Request
   9 frame could result in such a case ending up using (read+write) freed
  10 memory. This could only by triggered when the peer table has reached its
  11 maximum size and the PD Request frame is received from the P2P Device
  12 Address of the oldest remaining entry and the frame has incorrect P2P
  13 Device Address in the payload.
  14
  15 Fix this by fetching the dev pointer again after having called
  16 p2p_add_device() so that the stale pointer cannot be used.
  17
  18 Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request")
  19 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
  20 ---
  21  src/p2p/p2p_pd.c | 12 +++++-------
  22  1 file changed, 5 insertions(+), 7 deletions(-)
  23
  24 --- a/src/p2p/p2p_pd.c
  25 +++ b/src/p2p/p2p_pd.c
  26 @@ -595,14 +595,12 @@ void p2p_process_prov_disc_req(struct p2
  27                         goto out;
  28                 }
  29
  30 +               dev = p2p_get_device(p2p, sa);
  31                 if (!dev) {
  32 -                       dev = p2p_get_device(p2p, sa);
  33 -                       if (!dev) {
  34 -                               p2p_dbg(p2p,
  35 -                                       "Provision Discovery device not found "
  36 -                                       MACSTR, MAC2STR(sa));
  37 -                               goto out;
  38 -                       }
  39 +                       p2p_dbg(p2p,
  40 +                               "Provision Discovery device not found "
  41 +                               MACSTR, MAC2STR(sa));
  42 +                       goto out;
  43                 }
  44         } else if (msg.wfd_subelems) {
  45                 wpabuf_free(dev->info.wfd_subelems);