Re: [PATCH v2] wifi: cfg80211: Fix UAF in ieee80211_scan_rx()

From: Greg KH
Date: Fri Aug 12 2022 - 11:30:41 EST


On Fri, Aug 12, 2022 at 08:03:05PM +0530, Siddh Raman Pant wrote:
> On Fri, 12 Aug 2022 17:45:58 +0530 Greg KH wrote:
> > The merge window is for new features to be added, bugfixes can be merged
> > at any point in time, but most maintainers close their trees until after
> > the merge window is closed before accepting new fixes, like this one.
> >
> > So just relax, wait another week or so, and if there's no response,
> > resend it then.
> >
>
> Okay, sure.
>
> > Personally, this patch seems very incorrect, but hey, I'm not the wifi
> > subsystem maintainer :)
>
> Why do you think so?

rcu just delays freeing of an object, you might just be delaying the
race condition. Just moving a single object to be freed with rcu feels
very odd if you don't have another reference somewhere.

Anyway, I don't know this codebase, so I could be totally wrong.

greg k-h