From 8722deef1500645714aff596d479ca5036c577ee Mon Sep 17 00:00:00 2001 From: Andriy Voskoboinyk Date: Sat, 28 May 2016 18:49:17 +0000 Subject: [PATCH] net80211: fix use-after-free in frame defragmentation procedure. - Assign frame sequence/fragment number before frame concatenation; otherwise, frame header pointer (wh) will be invalid. - Move this code block upper and eliminate duplicate 'lwh = mtod()' assignment. Tested with wpi(4) (transmitter) (STA mode) and urtwn(4) (receiver) (HOSTAP mode). --- sys/net80211/ieee80211_input.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/sys/net80211/ieee80211_input.c b/sys/net80211/ieee80211_input.c index 3836ee5ed270..e367ba251447 100644 --- a/sys/net80211/ieee80211_input.c +++ b/sys/net80211/ieee80211_input.c @@ -227,9 +227,16 @@ ieee80211_defrag(struct ieee80211_node *ni, struct mbuf *m, int hdrspace) lwh = mtod(mfrag, struct ieee80211_frame *); last_rxseq = le16toh(*(uint16_t *)lwh->i_seq); /* NB: check seq # and frag together */ - if (rxseq != last_rxseq+1 || - !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) || - !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) { + if (rxseq == last_rxseq+1 && + IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) && + IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) { + /* XXX clear MORE_FRAG bit? */ + /* track last seqnum and fragno */ + *(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq; + + m_adj(m, hdrspace); /* strip header */ + m_catpkt(mfrag, m); /* concatenate */ + } else { /* * Unrelated fragment or no space for it, * clear current fragments. @@ -247,12 +254,6 @@ ieee80211_defrag(struct ieee80211_node *ni, struct mbuf *m, int hdrspace) return NULL; } mfrag = m; - } else { /* concatenate */ - m_adj(m, hdrspace); /* strip header */ - m_catpkt(mfrag, m); - /* track last seqnum and fragno */ - lwh = mtod(mfrag, struct ieee80211_frame *); - *(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq; } if (more_frag) { /* more to come, save */ ni->ni_rxfragstamp = ticks;