From nobody Thu May 8 21:23:31 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZtlVW5njMz5vdxZ; Thu, 08 May 2025 21:23:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4ZtlVW32xvz3Rbv; Thu, 08 May 2025 21:23:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1746739411; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=w9Lw9V5Kr5pDW+fkHRf/gx3WuxVMECGuaaDgnMxR0Ec=; b=MkIIIPBwAP4hh5SaoWGRduyu0Znciv+feQfBfRJ/A8CZhwjYVi7i2eP6DcCq9x9g+sLiWk zz5w0atsD7E2y1cuEZEmfmv+z2y6DlXqg/MPjUTlD9jzH872lx9rsyUuXXDYu3H6wsVzEP SBXpT4vEGTlwRos/vrCLt7Z8qquupqxZWlnypinXpdTfAtCo7vhdAOdzyvItX++lICHID0 IIO4dPOkgYi5H1Hac+d6LFuxV0S1qRTPexLOis3NGUcEZC3HSlQ0/zUwSX3fVVe8xN/Lw5 N1mHKBprJpXV7Y2Q2yuF1MLo+O0oAwGRXrSYIgC8yNjjiCoNw2UCaGtQ3hEpNQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1746739411; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=w9Lw9V5Kr5pDW+fkHRf/gx3WuxVMECGuaaDgnMxR0Ec=; b=g6hgyDQ/7nPK8Lz+yPdbYZd86RmJSYILJgn5KUqfRDdGh1nKHATD8TMCUKx7aNkR9w22SZ KS9u58TqO0RHQ0CVbtj2DoLBkAFnHk47CkaAqoDna5dVF7dk6RYkAIf9d2aEx1dJyiKbR4 xVc51ahUpbgz2X/MjvcQKIkNs3Srk0hqFAnKdRxktVoeL5eEwKtYWx5gXlwlAkETb5TWIi +O3mfUESm3Ch+CGEVcraOevtqC2X41Q2v58JhaImD9bIOIcRKRTxH9vy21XR+mT9m+rCLS H8duaJUPuCzJRDBO9/j7LHcpfUiecA4a1w2ONs7ELayGu3r5RY9t7w2AB6CfDg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1746739411; a=rsa-sha256; cv=none; b=ITQ1tMQBFZ2hLcZpn3zLp8Tjwfa3nkd9A6U+163DHr5QLDY0CQLnh7FGwWEiAnbmbhb+Ea 1LNNnFKadaD9WJqlj1Ez7F7qFiToCe11ZFyzFYJgeLHzgqpniY4L5fZjdaS1rsU1woeAkQ CLFqUQSwnAY51MuPrFYRI3+hLXXi4YB72x/vaIuD3bAR8yQRN7kEsoXbm5JBfggJEvuXwR knV7YyYYCxZbAZyosu6BwsN8IMrDUeBpdUljM+g6lijiKRmSSeOK5QLJUbIJXk01eDodaX RgbyjiWq+uwaL3mOVBL878aI9gh9hne7rSWkk+z1jMbVPeImcvVJQyHZNDGzGQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4ZtlVW2cMrzXXt; Thu, 08 May 2025 21:23:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 548LNVsr073223; Thu, 8 May 2025 21:23:31 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 548LNVRJ073220; Thu, 8 May 2025 21:23:31 GMT (envelope-from git) Date: Thu, 8 May 2025 21:23:31 GMT Message-Id: <202505082123.548LNVRJ073220@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: "Bjoern A. Zeeb" Subject: git: 8d6b75819946 - releng/14.3 - net80211: fix a race between ieee80211_sta_join and scan entries List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 8d6b75819946c5b01281dc93e3b0df049340f9b6 Auto-Submitted: auto-generated The branch releng/14.3 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=8d6b75819946c5b01281dc93e3b0df049340f9b6 commit 8d6b75819946c5b01281dc93e3b0df049340f9b6 Author: Bjoern A. Zeeb AuthorDate: 2025-04-16 19:10:58 +0000 Commit: Bjoern A. Zeeb CommitDate: 2025-05-08 21:22:59 +0000 net80211: fix a race between ieee80211_sta_join and scan entries We were seeing panics during ieee80211_sta_join() which seemed that the ni->ni_chan was not valid anymore, which was true. We also saw errors indicating data put into ni_ies became inalid. The problem was that the ieee80211_scan_entry passed into ieee80211_sta_join() (in the observed case from setmlme_assoc_sta()) became invalid during ieee80211_alloc_node(). As a result for the ni_chan case the the rateset and len in rates[1] became invalid. Similarly for the IEs. Make a (deep)copy of the scan entry in setmlme_assoc_sta() and return the copy as once we leave ieee80211_scan_iterate() we can no longer rely on the scan entry to be valid. Sponsored by: The FreeBSD Foundation Reported by: rm, ziaee, bz Tested by: rm, ziaee, bz PR: 286063 Approved by: re (cperciva) Reviewed by: adrian (,emaste) Differential Revision: https://reviews.freebsd.org/D49865 (cherry picked from commit aff56b4f0b25c44c9c2cae9a3f816c4277057a71) (cherry picked from commit 34cd36918652f07ea8a36a62115349781e457fc6) --- sys/net80211/ieee80211_ioctl.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/sys/net80211/ieee80211_ioctl.c b/sys/net80211/ieee80211_ioctl.c index 3b57e7d8cd8e..7447e3a05ed3 100644 --- a/sys/net80211/ieee80211_ioctl.c +++ b/sys/net80211/ieee80211_ioctl.c @@ -1534,7 +1534,8 @@ struct scanlookup { const uint8_t *mac; int esslen; const uint8_t *essid; - const struct ieee80211_scan_entry *se; + bool found; + struct ieee80211_scan_entry se; }; /* @@ -1544,6 +1545,10 @@ static void mlmelookup(void *arg, const struct ieee80211_scan_entry *se) { struct scanlookup *look = arg; + int rv; + + if (look->found) + return; if (!IEEE80211_ADDR_EQ(look->mac, se->se_macaddr)) return; @@ -1553,7 +1558,14 @@ mlmelookup(void *arg, const struct ieee80211_scan_entry *se) if (memcmp(look->essid, se->se_ssid+2, look->esslen)) return; } - look->se = se; + /* + * First copy everything and then ensure we get our own copy of se_ies. */ + look->se = *se; + look->se.se_ies.data = 0; + look->se.se_ies.len = 0; + rv = ieee80211_ies_init(&look->se.se_ies, se->se_ies.data, se->se_ies.len); + if (rv != 0) /* No error */ + look->found = true; } static int @@ -1562,21 +1574,25 @@ setmlme_assoc_sta(struct ieee80211vap *vap, const uint8_t ssid[IEEE80211_NWID_LEN]) { struct scanlookup lookup; + int rv; KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("expected opmode STA not %s", ieee80211_opmode_name[vap->iv_opmode])); /* NB: this is racey if roaming is !manual */ - lookup.se = NULL; lookup.mac = mac; lookup.esslen = ssid_len; lookup.essid = ssid; + memset(&lookup.se, 0, sizeof(lookup.se)); + lookup.found = false; ieee80211_scan_iterate(vap, mlmelookup, &lookup); - if (lookup.se == NULL) + if (!lookup.found) return ENOENT; mlmedebug(vap, mac, IEEE80211_MLME_ASSOC, 0); - if (!ieee80211_sta_join(vap, lookup.se->se_chan, lookup.se)) + rv = ieee80211_sta_join(vap, lookup.se.se_chan, &lookup.se); + ieee80211_ies_cleanup(&lookup.se.se_ies); + if (rv == 0) return EIO; /* XXX unique but could be better */ return 0; }