1From 416bfaff988882c553c672e5bfc2d4f648d29e8a Mon Sep 17 00:00:00 2001 2From: Daniel Wagner <wagi@monom.org> 3Date: Tue, 5 Jul 2022 09:11:09 +0200 4Subject: wispr: Update portal context references 5 6Maintain proper portal context references to avoid UAF. 7 8Fixes: CVE-2022-32293 9CVE: CVE-2022-32293 10Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=72343929836de80727a27d6744c869dff045757c] 11Signed-off-by: Khem Raj <raj.khem@gmail.com> 12--- 13 src/wispr.c | 34 ++++++++++++++++++++++------------ 14 1 file changed, 22 insertions(+), 12 deletions(-) 15 16diff --git a/src/wispr.c b/src/wispr.c 17index bde7e63b..84bed33f 100644 18--- a/src/wispr.c 19+++ b/src/wispr.c 20@@ -105,8 +105,6 @@ static bool enable_online_to_ready_transition = false; 21 22 static void connman_wispr_message_init(struct connman_wispr_message *msg) 23 { 24- DBG(""); 25- 26 msg->has_error = false; 27 msg->current_element = NULL; 28 29@@ -166,8 +164,6 @@ static void free_wispr_routes(struct connman_wispr_portal_context *wp_context) 30 static void free_connman_wispr_portal_context( 31 struct connman_wispr_portal_context *wp_context) 32 { 33- DBG("context %p", wp_context); 34- 35 if (wp_context->wispr_portal) { 36 if (wp_context->wispr_portal->ipv4_context == wp_context) 37 wp_context->wispr_portal->ipv4_context = NULL; 38@@ -483,9 +479,6 @@ static void portal_manage_status(GWebResult *result, 39 &str)) 40 connman_info("Client-Timezone: %s", str); 41 42- if (!enable_online_to_ready_transition) 43- wispr_portal_context_unref(wp_context); 44- 45 __connman_service_ipconfig_indicate_state(service, 46 CONNMAN_SERVICE_STATE_ONLINE, type); 47 48@@ -546,14 +539,17 @@ static void wispr_portal_request_portal( 49 { 50 DBG(""); 51 52+ wispr_portal_context_ref(wp_context); 53 wp_context->request_id = g_web_request_get(wp_context->web, 54 wp_context->status_url, 55 wispr_portal_web_result, 56 wispr_route_request, 57 wp_context); 58 59- if (wp_context->request_id == 0) 60+ if (wp_context->request_id == 0) { 61 wispr_portal_error(wp_context); 62+ wispr_portal_context_unref(wp_context); 63+ } 64 } 65 66 static bool wispr_input(const guint8 **data, gsize *length, 67@@ -618,13 +614,15 @@ static void wispr_portal_browser_reply_cb(struct connman_service *service, 68 return; 69 70 if (!authentication_done) { 71- wispr_portal_error(wp_context); 72 free_wispr_routes(wp_context); 73+ wispr_portal_error(wp_context); 74+ wispr_portal_context_unref(wp_context); 75 return; 76 } 77 78 /* Restarting the test */ 79 __connman_service_wispr_start(service, wp_context->type); 80+ wispr_portal_context_unref(wp_context); 81 } 82 83 static void wispr_portal_request_wispr_login(struct connman_service *service, 84@@ -700,11 +698,13 @@ static bool wispr_manage_message(GWebResult *result, 85 86 wp_context->wispr_result = CONNMAN_WISPR_RESULT_LOGIN; 87 88+ wispr_portal_context_ref(wp_context); 89 if (__connman_agent_request_login_input(wp_context->service, 90 wispr_portal_request_wispr_login, 91- wp_context) != -EINPROGRESS) 92+ wp_context) != -EINPROGRESS) { 93 wispr_portal_error(wp_context); 94- else 95+ wispr_portal_context_unref(wp_context); 96+ } else 97 return true; 98 99 break; 100@@ -753,6 +753,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) 101 if (length > 0) { 102 g_web_parser_feed_data(wp_context->wispr_parser, 103 chunk, length); 104+ wispr_portal_context_unref(wp_context); 105 return true; 106 } 107 108@@ -770,6 +771,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) 109 110 switch (status) { 111 case 000: 112+ wispr_portal_context_ref(wp_context); 113 __connman_agent_request_browser(wp_context->service, 114 wispr_portal_browser_reply_cb, 115 wp_context->status_url, wp_context); 116@@ -781,11 +783,14 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) 117 if (g_web_result_get_header(result, "X-ConnMan-Status", 118 &str)) { 119 portal_manage_status(result, wp_context); 120+ wispr_portal_context_unref(wp_context); 121 return false; 122- } else 123+ } else { 124+ wispr_portal_context_ref(wp_context); 125 __connman_agent_request_browser(wp_context->service, 126 wispr_portal_browser_reply_cb, 127 wp_context->redirect_url, wp_context); 128+ } 129 130 break; 131 case 300: 132@@ -798,6 +803,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) 133 !g_web_result_get_header(result, "Location", 134 &redirect)) { 135 136+ wispr_portal_context_ref(wp_context); 137 __connman_agent_request_browser(wp_context->service, 138 wispr_portal_browser_reply_cb, 139 wp_context->status_url, wp_context); 140@@ -808,6 +814,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) 141 142 wp_context->redirect_url = g_strdup(redirect); 143 144+ wispr_portal_context_ref(wp_context); 145 wp_context->request_id = g_web_request_get(wp_context->web, 146 redirect, wispr_portal_web_result, 147 wispr_route_request, wp_context); 148@@ -820,6 +827,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) 149 150 break; 151 case 505: 152+ wispr_portal_context_ref(wp_context); 153 __connman_agent_request_browser(wp_context->service, 154 wispr_portal_browser_reply_cb, 155 wp_context->status_url, wp_context); 156@@ -832,6 +840,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) 157 wp_context->request_id = 0; 158 done: 159 wp_context->wispr_msg.message_type = -1; 160+ wispr_portal_context_unref(wp_context); 161 return false; 162 } 163 164@@ -890,6 +899,7 @@ static void proxy_callback(const char *proxy, void *user_data) 165 xml_wispr_parser_callback, wp_context); 166 167 wispr_portal_request_portal(wp_context); 168+ wispr_portal_context_unref(wp_context); 169 } 170 171 static gboolean no_proxy_callback(gpointer user_data) 172-- 173cgit 174 175