claude-noether
8b356aa11f
Replaces the 13 broken DKMS-path -danctnix mirrors from PR #17 + adds 9 new series-dirs for the c-stack patches that were never split (Patches A/B/C-v3/F/D/E/C2/G/H) + retires the cumulative-c5x-danctnix single-file interim from fleet/ohm.yaml. Mechanism: cd marfrit/bes2600-dkms-mobian git format-patch fe73571..cleanups --no-merges -o /tmp/cleanups/ git format-patch cleanups..bes2600/bh-c-fossil-cleanup --no-merges -o /tmp/h/ for each commit: route to series-dir, sed-rewrite a/bes2600/foo.c -> a/drivers/staging/bes2600/foo.c The 29 cleanups commits + 1 Patch H commit map to 25 series-dirs (a few series-dirs get multiple commits: lmac-recover gets c5.2 + c5.2.1 as 0001+0002; cw1200-fix-backports gets F3+F2+F1 as 0001-0003; factory-series gets request_firmware + STANDARD_FACTORY_EFUSE_FLAG as 0001+0002). fleet/ohm.yaml apply order matches cleanups commit chronology, which is what produced the working c5x interim. cumulative.patch from ka-promote ohm now has 32 resolved patches (29 cleanups + 1 Patch H + scan-filter-5ghz + xor-neon SCS + besser#18-fix), 276 079 bytes, b2sum 7418db5ddf8fe938b130bc9d0e9f7dc9060f3a13703cd50757835ac43140a13... Apply order in cleanups + bh-c-fossil-cleanup: 1 factory-series (c1 + factory-no-efuse-flag) 3 factory-thread-dev 4 pm-gate-on-handshake 5 remove-chardev-user-interface 6 enable-testmode 7 tx-sdio-dma-oob-danctnix (was 'staging-prep-series') 8 factory-drop-kernel-write-danctnix 9 drop-dpd-file-paths-danctnix 10 drop-orphan-file-io-danctnix 11 pm-timeout-silence-danctnix 12 scan-defer-on-reject-danctnix (c5.1) 13 scan-defer-backoff-tune-danctnix (c5.1.1) 14 lmac-recover-via-mmc-hw-reset-danctnix (c5.2 + c5.2.1) 16 pm-state-resync-danctnix (c6.1) 17 pm-wake-consume-state-danctnix (c6.2) 18 pm-detect-firmware-unsupported-danctnix (c7) 19 decrypt-storm-fast-recover-danctnix (Patch A) 20 connection-loss-fast-recover-danctnix (Patch B) 21 cw1200-fix-backports-danctnix (Patches F3 + F2 + F1) 24 sdio-rx-no-relay-danctnix (Patch C v3) 25 license-spdx-restore-attribution-danctnix (Patch G) 26 ba-lock-atomic-danctnix (Patch D) 27 ps-state-lock-skip-pm-disabled-danctnix (Patch E) 28 rx-list-batch-delivery-danctnix (Patch C2) 29 bh-c-fossil-cleanup-danctnix (Patch H) 30 scan-filter-5ghz-danctnix (besser#1) 31 arch/arm64/xor-neon-... (GCC 15 SCS) 32 queue-pending-record-lock-bh-danctnix (besser#18) Verification: pkgrel=6 build from this manifest in progress; if srcversion == 26B0003FE9F2B05DCE838C4 (pkgrel=5's), source-tree is byte-equivalent to the c5x interim + scan-filter + besser#18 stack that's currently running on ohm. Refs: #17 (the broken mirror), #28 (the interim PR that landed cumulative-c5x), #31 (ka-promote trailer normalisation followup).
145 lines
4.4 KiB
Diff
145 lines
4.4 KiB
Diff
From b717251598c95bb7ce7822ffa103216598f19b67 Mon Sep 17 00:00:00 2001
|
|
From: Markus Fritsche <fritsche.markus@gmail.com>
|
|
Date: Thu, 7 May 2026 21:24:01 +0200
|
|
Subject: [PATCH 24/29] bes2600: fix concurrency UAF in bes2600_hw_scan and
|
|
sched_scan
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
bes2600_bss_info_changed() and bes2600_hw_scan() can run concurrently.
|
|
The probe-request SKB allocated by ieee80211_probereq_get() before
|
|
scan.lock + conf_lock are taken can be touched by a concurrent
|
|
bss_info_changed (via wsm_set_template_frame's path) while we hold no
|
|
lock. Reorder to acquire both locks BEFORE the SKB allocation.
|
|
|
|
Also reorder cleanup paths so dev_kfree_skb() runs BEFORE up() —
|
|
otherwise a small window exists where the SKB has been touched but the
|
|
lock has been released, allowing concurrent code to also touch it.
|
|
|
|
Three sites fixed:
|
|
- bes2600_hw_scan: lock-take + ENOMEM cleanup + wsm_set_template_frame
|
|
error cleanup + success-path SKB free + lock release order
|
|
- bes2600_sched_scan_start (#ifdef ROAM_OFFLOAD): same three sub-fixes
|
|
(compiled-out at default build, fixed for consistency)
|
|
- All success/error paths: dev_kfree_skb before up()
|
|
|
|
Backport of cw1200 mainline commit 86760e0dfe36 ("cw1200: Fix
|
|
concurrency use-after-free bugs in cw1200_hw_scan()", 2018-12-14),
|
|
which fixed the identical bug in the same code shape we inherited.
|
|
That commit was merged from upstream 4f68ef64cd7f.
|
|
|
|
Cherry-picked from upstream Linux:
|
|
86760e0dfe36 cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()
|
|
Author: Jia-Ju Bai <baijiaju1990@gmail.com>
|
|
Link: https://lore.kernel.org/r/20181214035521.7575-1-baijiaju1990@gmail.com
|
|
---
|
|
bes2600/scan.c | 37 ++++++++++++++++++++++---------------
|
|
1 file changed, 22 insertions(+), 15 deletions(-)
|
|
|
|
diff --git a/drivers/staging/bes2600/scan.c b/drivers/staging/bes2600/scan.c
|
|
index ad5033b..16b5d0f 100644
|
|
--- a/drivers/staging/bes2600/scan.c
|
|
+++ b/drivers/staging/bes2600/scan.c
|
|
@@ -257,18 +257,21 @@ int bes2600_hw_scan(struct ieee80211_hw *hw,
|
|
|
|
bes2600_pwr_set_busy_event(hw_priv, BES_PWR_LOCK_ON_SCAN);
|
|
|
|
+ /* will be unlocked in bes2600_scan_work() */
|
|
+ down(&hw_priv->scan.lock);
|
|
+ down(&hw_priv->conf_lock);
|
|
+
|
|
frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
|
|
req->ie_len);
|
|
- if (!frame.skb)
|
|
+ if (!frame.skb) {
|
|
+ up(&hw_priv->conf_lock);
|
|
+ up(&hw_priv->scan.lock);
|
|
return -ENOMEM;
|
|
+ }
|
|
|
|
if (req->ie_len)
|
|
skb_put_data(frame.skb, req->ie, req->ie_len);
|
|
|
|
- /* will be unlocked in bes2600_scan_work() */
|
|
- down(&hw_priv->scan.lock);
|
|
- down(&hw_priv->conf_lock);
|
|
-
|
|
if (frame.skb) {
|
|
int ret;
|
|
//if (priv->if_id == 0)
|
|
@@ -286,9 +289,9 @@ int bes2600_hw_scan(struct ieee80211_hw *hw,
|
|
}
|
|
#endif
|
|
if (ret) {
|
|
+ dev_kfree_skb(frame.skb);
|
|
up(&hw_priv->conf_lock);
|
|
up(&hw_priv->scan.lock);
|
|
- dev_kfree_skb(frame.skb);
|
|
return ret;
|
|
}
|
|
}
|
|
@@ -318,10 +321,10 @@ int bes2600_hw_scan(struct ieee80211_hw *hw,
|
|
++hw_priv->scan.n_ssids;
|
|
}
|
|
|
|
- up(&hw_priv->conf_lock);
|
|
-
|
|
if (frame.skb)
|
|
dev_kfree_skb(frame.skb);
|
|
+
|
|
+ up(&hw_priv->conf_lock);
|
|
#ifdef WIFI_BT_COEXIST_EPTA_ENABLE
|
|
bwifi_change_current_status(hw_priv, BWIFI_STATUS_SCANNING);
|
|
#endif
|
|
@@ -362,14 +365,18 @@ int bes2600_hw_sched_scan_start(struct ieee80211_hw *hw,
|
|
if (req->n_ssids > hw->wiphy->max_scan_ssids)
|
|
return -EINVAL;
|
|
|
|
+ /* will be unlocked in bes2600_scan_work() */
|
|
+ down(&hw_priv->scan.lock);
|
|
+ down(&hw_priv->conf_lock);
|
|
+
|
|
frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
|
|
req->ie_len);
|
|
- if (!frame.skb)
|
|
+ if (!frame.skb) {
|
|
+ up(&hw_priv->conf_lock);
|
|
+ up(&hw_priv->scan.lock);
|
|
return -ENOMEM;
|
|
+ }
|
|
|
|
- /* will be unlocked in bes2600_scan_work() */
|
|
- down(&hw_priv->scan.lock);
|
|
- down(&hw_priv->conf_lock);
|
|
if (frame.skb) {
|
|
int ret;
|
|
if (priv->if_id == 0)
|
|
@@ -380,9 +387,9 @@ int bes2600_hw_sched_scan_start(struct ieee80211_hw *hw,
|
|
ret = wsm_set_probe_responder(priv, true);
|
|
}
|
|
if (ret) {
|
|
+ dev_kfree_skb(frame.skb);
|
|
up(&hw_priv->conf_lock);
|
|
up(&hw_priv->scan.lock);
|
|
- dev_kfree_skb(frame.skb);
|
|
return ret;
|
|
}
|
|
}
|
|
@@ -414,10 +421,10 @@ int bes2600_hw_sched_scan_start(struct ieee80211_hw *hw,
|
|
}
|
|
}
|
|
|
|
- up(&hw_priv->conf_lock);
|
|
-
|
|
if (frame.skb)
|
|
dev_kfree_skb(frame.skb);
|
|
+
|
|
+ up(&hw_priv->conf_lock);
|
|
queue_work(hw_priv->workqueue, &hw_priv->scan.swork);
|
|
wiphy_warn(hw->wiphy, "<--[SCAN] Scheduled scan request.\n");
|
|
return 0;
|
|
--
|
|
2.54.0
|
|
|