In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: mesh: Fix leak of meshpreqqueue objects
The hwmp code use objects of type meshpreqqueue, added to a list in ieee80211ifmesh, to keep track of mpath we need to resolve. If the mpath gets deleted, ex mesh interface is removed, the entries in that list will never get cleaned. Fix this by flushing all corresponding items of the preqqueue in meshpathflushpending().
This should take care of KASAN reports like this:
unreferenced object 0xffff00000668d800 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419552 (age 1836.444s) hex dump (first 32 bytes): 00 1f 05 09 00 00 ff ff 00 d5 68 06 00 00 ff ff ..........h..... 8e 97 ea eb 3e b8 01 00 00 00 00 00 00 00 00 00 ....>........... backtrace: [<000000007302a0b6>] _kmemcacheallocnode+0x1e0/0x35c [<00000000049bd418>] kmalloctrace+0x34/0x80 [<0000000000d792bb>] meshqueuepreq+0x44/0x2a8 [<00000000c99c3696>] meshnexthopresolve+0x198/0x19c [<00000000926bf598>] ieee80211xmit+0x1d0/0x1f4 [<00000000fc8c2284>] _ieee80211subifstartxmit+0x30c/0x764 [<000000005926ee38>] ieee80211subifstartxmit+0x9c/0x7a4 [<000000004c86e916>] devhardstartxmit+0x174/0x440 [<0000000023495647>] _devqueuexmit+0xe24/0x111c [<00000000cfe9ca78>] batadvsendskbpacket+0x180/0x1e4 [<000000007bacc5d5>] batadvvelpperiodicwork+0x2f4/0x508 [<00000000adc3cd94>] processonework+0x4b8/0xa1c [<00000000b36425d1>] workerthread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] retfromfork+0x10/0x20 unreferenced object 0xffff000009051f00 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419553 (age 1836.440s) hex dump (first 32 bytes): 90 d6 92 0d 00 00 ff ff 00 d8 68 06 00 00 ff ff ..........h..... 36 27 92 e4 02 e0 01 00 00 58 79 06 00 00 ff ff 6'.......Xy..... backtrace: [<000000007302a0b6>] _kmemcacheallocnode+0x1e0/0x35c [<00000000049bd418>] kmalloctrace+0x34/0x80 [<0000000000d792bb>] meshqueuepreq+0x44/0x2a8 [<00000000c99c3696>] meshnexthopresolve+0x198/0x19c [<00000000926bf598>] ieee80211xmit+0x1d0/0x1f4 [<00000000fc8c2284>] _ieee80211subifstartxmit+0x30c/0x764 [<000000005926ee38>] ieee80211subifstartxmit+0x9c/0x7a4 [<000000004c86e916>] devhardstartxmit+0x174/0x440 [<0000000023495647>] _devqueuexmit+0xe24/0x111c [<00000000cfe9ca78>] batadvsendskbpacket+0x180/0x1e4 [<000000007bacc5d5>] batadvvelpperiodicwork+0x2f4/0x508 [<00000000adc3cd94>] processonework+0x4b8/0xa1c [<00000000b36425d1>] workerthread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] retfromfork+0x10/0x20
[
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c",
"function": "mesh_path_flush_pending"
},
"digest": {
"length": 150.0,
"function_hash": "25969672329578110122696004519608854667"
},
"id": "CVE-2024-40942-016eeded",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@617dadbfb2d3e152c5753e28356d189c9d6f33c0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c",
"function": "mesh_path_flush_pending"
},
"digest": {
"length": 150.0,
"function_hash": "25969672329578110122696004519608854667"
},
"id": "CVE-2024-40942-4690f521",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7518e20a189f8659b8b83969db4d33a4068fcfc3",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"104235751630437036847242216691932908265",
"256882995787586222203130992481816815802",
"126699720870792887932886285244368020199",
"177532158702828751257265366273074780333",
"125753541935564332243428435888424609907",
"181863279638489810164233156421110936693",
"151089650449488905969360711161680591378"
]
},
"id": "CVE-2024-40942-4ba85df2",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7518e20a189f8659b8b83969db4d33a4068fcfc3",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c",
"function": "mesh_path_flush_pending"
},
"digest": {
"length": 150.0,
"function_hash": "25969672329578110122696004519608854667"
},
"id": "CVE-2024-40942-5e39f590",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4c865f971fd4a255208f57ef04d814c2ae9e0dc",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c",
"function": "mesh_path_flush_pending"
},
"digest": {
"length": 150.0,
"function_hash": "25969672329578110122696004519608854667"
},
"id": "CVE-2024-40942-7709f4a2",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@377dbb220edc8421b7960691876c5b3bef62f89b",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"104235751630437036847242216691932908265",
"256882995787586222203130992481816815802",
"126699720870792887932886285244368020199",
"177532158702828751257265366273074780333",
"125753541935564332243428435888424609907",
"181863279638489810164233156421110936693",
"151089650449488905969360711161680591378"
]
},
"id": "CVE-2024-40942-80f8b621",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4c865f971fd4a255208f57ef04d814c2ae9e0dc",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c",
"function": "mesh_path_flush_pending"
},
"digest": {
"length": 150.0,
"function_hash": "25969672329578110122696004519608854667"
},
"id": "CVE-2024-40942-82098761",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7d7f11a291830fdf69d3301075dd0fb347ced84",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c",
"function": "mesh_path_flush_pending"
},
"digest": {
"length": 150.0,
"function_hash": "25969672329578110122696004519608854667"
},
"id": "CVE-2024-40942-8ed82ce1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63d5f89bb5664d60edbf8cf0df911aaae8ed96a4",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"104235751630437036847242216691932908265",
"256882995787586222203130992481816815802",
"126699720870792887932886285244368020199",
"177532158702828751257265366273074780333",
"125753541935564332243428435888424609907",
"181863279638489810164233156421110936693",
"151089650449488905969360711161680591378"
]
},
"id": "CVE-2024-40942-95a35172",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@377dbb220edc8421b7960691876c5b3bef62f89b",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"104235751630437036847242216691932908265",
"256882995787586222203130992481816815802",
"126699720870792887932886285244368020199",
"177532158702828751257265366273074780333",
"125753541935564332243428435888424609907",
"181863279638489810164233156421110936693",
"151089650449488905969360711161680591378"
]
},
"id": "CVE-2024-40942-b9e06ea1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@617dadbfb2d3e152c5753e28356d189c9d6f33c0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"104235751630437036847242216691932908265",
"256882995787586222203130992481816815802",
"126699720870792887932886285244368020199",
"177532158702828751257265366273074780333",
"125753541935564332243428435888424609907",
"181863279638489810164233156421110936693",
"151089650449488905969360711161680591378"
]
},
"id": "CVE-2024-40942-bd74e3ef",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7d7f11a291830fdf69d3301075dd0fb347ced84",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"104235751630437036847242216691932908265",
"256882995787586222203130992481816815802",
"126699720870792887932886285244368020199",
"177532158702828751257265366273074780333",
"125753541935564332243428435888424609907",
"181863279638489810164233156421110936693",
"151089650449488905969360711161680591378"
]
},
"id": "CVE-2024-40942-c2ffe3ec",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec79670eae430b3ffb7e0a6417ad7657728b8f95",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"104235751630437036847242216691932908265",
"256882995787586222203130992481816815802",
"126699720870792887932886285244368020199",
"177532158702828751257265366273074780333",
"125753541935564332243428435888424609907",
"181863279638489810164233156421110936693",
"151089650449488905969360711161680591378"
]
},
"id": "CVE-2024-40942-d3ce32dc",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d81e244af521de63ad2883e17571b789c39b6549",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c",
"function": "mesh_path_flush_pending"
},
"digest": {
"length": 150.0,
"function_hash": "25969672329578110122696004519608854667"
},
"id": "CVE-2024-40942-d9dd70d6",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec79670eae430b3ffb7e0a6417ad7657728b8f95",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c",
"function": "mesh_path_flush_pending"
},
"digest": {
"length": 150.0,
"function_hash": "25969672329578110122696004519608854667"
},
"id": "CVE-2024-40942-e1b76f00",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d81e244af521de63ad2883e17571b789c39b6549",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mac80211/mesh_pathtbl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"104235751630437036847242216691932908265",
"256882995787586222203130992481816815802",
"126699720870792887932886285244368020199",
"177532158702828751257265366273074780333",
"125753541935564332243428435888424609907",
"181863279638489810164233156421110936693",
"151089650449488905969360711161680591378"
]
},
"id": "CVE-2024-40942-f1c45f31",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63d5f89bb5664d60edbf8cf0df911aaae8ed96a4",
"signature_version": "v1"
}
]