| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960 |
- From a50e5fb8db83c5b57392204c21ea6c5c4ccefde6 Mon Sep 17 00:00:00 2001
- From: Sara Sharon <[email protected]>
- Date: Sat, 15 Dec 2018 11:03:10 +0200
- Subject: [PATCH 1/3] mac80211: fix a kernel panic when TXing after TXQ
- teardown
- Recently TXQ teardown was moved earlier in ieee80211_unregister_hw(),
- to avoid a use-after-free of the netdev data. However, interfaces
- aren't fully removed at the point, and cfg80211_shutdown_all_interfaces
- can for example, TX a deauth frame. Move the TXQ teardown to the
- point between cfg80211_shutdown_all_interfaces and the free of
- netdev queues, so we can be sure they are torn down before netdev
- is freed, but after there is no ongoing TX.
- Fixes: 77cfaf52eca5 ("mac80211: Run TXQ teardown code before de-registering interfaces")
- Signed-off-by: Sara Sharon <[email protected]>
- Signed-off-by: Luca Coelho <[email protected]>
- Signed-off-by: Johannes Berg <[email protected]>
- ---
- net/mac80211/iface.c | 3 +++
- net/mac80211/main.c | 2 --
- 2 files changed, 3 insertions(+), 2 deletions(-)
- --- a/net/mac80211/iface.c
- +++ b/net/mac80211/iface.c
- @@ -7,6 +7,7 @@
- * Copyright 2008, Johannes Berg <[email protected]>
- * Copyright 2013-2014 Intel Mobile Communications GmbH
- * Copyright (c) 2016 Intel Deutschland GmbH
- + * Copyright (C) 2018 Intel Corporation
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- @@ -2035,6 +2036,8 @@ void ieee80211_remove_interfaces(struct
- WARN(local->open_count, "%s: open count remains %d\n",
- wiphy_name(local->hw.wiphy), local->open_count);
-
- + ieee80211_txq_teardown_flows(local);
- +
- mutex_lock(&local->iflist_mtx);
- list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
- list_del(&sdata->list);
- --- a/net/mac80211/main.c
- +++ b/net/mac80211/main.c
- @@ -1200,7 +1200,6 @@ int ieee80211_register_hw(struct ieee802
- rtnl_unlock();
- ieee80211_led_exit(local);
- ieee80211_wep_free(local);
- - ieee80211_txq_teardown_flows(local);
- fail_flows:
- destroy_workqueue(local->workqueue);
- fail_workqueue:
- @@ -1226,7 +1225,6 @@ void ieee80211_unregister_hw(struct ieee
- #if IS_ENABLED(__disabled__CONFIG_IPV6)
- unregister_inet6addr_notifier(&local->ifa6_notifier);
- #endif
- - ieee80211_txq_teardown_flows(local);
-
- rtnl_lock();
-
|
