mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-22 23:12:32 +00:00
4b60ea236e
d350a0f43118 nl80211: fix memory leak if validate_pae_over_nl80211() fails a50e5fb8db83 mac80211: fix a kernel panic when TXing after TXQ teardown Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
61 lines
2.3 KiB
Diff
61 lines
2.3 KiB
Diff
From a50e5fb8db83c5b57392204c21ea6c5c4ccefde6 Mon Sep 17 00:00:00 2001
|
|
From: Sara Sharon <sara.sharon@intel.com>
|
|
Date: Sat, 15 Dec 2018 11:03:10 +0200
|
|
Subject: [PATCH 1/3] mac80211: fix a kernel panic when TXing after TXQ
|
|
teardown
|
|
|
|
Recently TXQ teardown was moved earlier in ieee80211_unregister_hw(),
|
|
to avoid a use-after-free of the netdev data. However, interfaces
|
|
aren't fully removed at the point, and cfg80211_shutdown_all_interfaces
|
|
can for example, TX a deauth frame. Move the TXQ teardown to the
|
|
point between cfg80211_shutdown_all_interfaces and the free of
|
|
netdev queues, so we can be sure they are torn down before netdev
|
|
is freed, but after there is no ongoing TX.
|
|
|
|
Fixes: 77cfaf52eca5 ("mac80211: Run TXQ teardown code before de-registering interfaces")
|
|
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
|
|
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
---
|
|
net/mac80211/iface.c | 3 +++
|
|
net/mac80211/main.c | 2 --
|
|
2 files changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
--- a/net/mac80211/iface.c
|
|
+++ b/net/mac80211/iface.c
|
|
@@ -7,6 +7,7 @@
|
|
* Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
|
|
* Copyright 2013-2014 Intel Mobile Communications GmbH
|
|
* Copyright (c) 2016 Intel Deutschland GmbH
|
|
+ * Copyright (C) 2018 Intel Corporation
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
@@ -2035,6 +2036,8 @@ void ieee80211_remove_interfaces(struct
|
|
WARN(local->open_count, "%s: open count remains %d\n",
|
|
wiphy_name(local->hw.wiphy), local->open_count);
|
|
|
|
+ ieee80211_txq_teardown_flows(local);
|
|
+
|
|
mutex_lock(&local->iflist_mtx);
|
|
list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
|
|
list_del(&sdata->list);
|
|
--- a/net/mac80211/main.c
|
|
+++ b/net/mac80211/main.c
|
|
@@ -1200,7 +1200,6 @@ int ieee80211_register_hw(struct ieee802
|
|
rtnl_unlock();
|
|
ieee80211_led_exit(local);
|
|
ieee80211_wep_free(local);
|
|
- ieee80211_txq_teardown_flows(local);
|
|
fail_flows:
|
|
destroy_workqueue(local->workqueue);
|
|
fail_workqueue:
|
|
@@ -1226,7 +1225,6 @@ void ieee80211_unregister_hw(struct ieee
|
|
#if IS_ENABLED(__disabled__CONFIG_IPV6)
|
|
unregister_inet6addr_notifier(&local->ifa6_notifier);
|
|
#endif
|
|
- ieee80211_txq_teardown_flows(local);
|
|
|
|
rtnl_lock();
|
|
|