From fd690d4fd9237e8040d16debb32e37aab127b7b1 Mon Sep 17 00:00:00 2001 From: Gokul Sivakumar Date: Thu, 23 Nov 2023 07:32:32 -0600 Subject: [PATCH 193/296] brcmfmac: avoid memory use-after-free in the escan timeout worker function With a WLAN chip plugged in over USB Bus, if an ongoing scan operation is interrupted with a sudden USB unplug, the brcmf_cfg80211_info struct memory would be freed, the pointer is set to NULL and the escan_timeout timer is cancelled if not fired yet. There is a rare chance for escan_timeout timer to have already fired and scheduled the escan_timeout_work, just before the USB unplug action frees the struct memory. When the scheduled work executes the already freed memory would get accessed. During this race condition, avoid this memory user-after-free error at the escan timeout worker function, by doing a NULL check and return. This Fixes CVE-2023-47233 Signed-off-by: Gokul Sivakumar --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index d0a76ea428f7..2a048fe28b26 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -4063,6 +4063,9 @@ static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work) container_of(work, struct brcmf_cfg80211_info, escan_timeout_work); + if (!cfg) + return; + brcmf_inform_bss(cfg); brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true); } -- 2.25.1