From 4b60ea236eff0703f220774f0fb2413a72ac8902 Mon Sep 17 00:00:00 2001 From: Koen Vandeputte Date: Wed, 19 Dec 2018 11:31:40 +0100 Subject: [PATCH] mac80211: backport upstream fixes d350a0f43118 nl80211: fix memory leak if validate_pae_over_nl80211() fails a50e5fb8db83 mac80211: fix a kernel panic when TXing after TXQ teardown Signed-off-by: Koen Vandeputte --- ...ernel-panic-when-TXing-after-TXQ-tea.patch | 60 +++++++++++++++++++ ...ry-leak-if-validate_pae_over_nl80211.patch | 29 +++++++++ 2 files changed, 89 insertions(+) create mode 100644 package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch create mode 100644 package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch diff --git a/package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch b/package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch new file mode 100644 index 0000000000..606897d1fe --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch @@ -0,0 +1,60 @@ +From a50e5fb8db83c5b57392204c21ea6c5c4ccefde6 Mon Sep 17 00:00:00 2001 +From: Sara Sharon +Date: Sat, 15 Dec 2018 11:03:10 +0200 +Subject: [PATCH 1/3] mac80211: fix a kernel panic when TXing after TXQ + teardown + +Recently TXQ teardown was moved earlier in ieee80211_unregister_hw(), +to avoid a use-after-free of the netdev data. However, interfaces +aren't fully removed at the point, and cfg80211_shutdown_all_interfaces +can for example, TX a deauth frame. Move the TXQ teardown to the +point between cfg80211_shutdown_all_interfaces and the free of +netdev queues, so we can be sure they are torn down before netdev +is freed, but after there is no ongoing TX. + +Fixes: 77cfaf52eca5 ("mac80211: Run TXQ teardown code before de-registering interfaces") +Signed-off-by: Sara Sharon +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +--- + net/mac80211/iface.c | 3 +++ + net/mac80211/main.c | 2 -- + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -7,6 +7,7 @@ + * Copyright 2008, Johannes Berg + * Copyright 2013-2014 Intel Mobile Communications GmbH + * Copyright (c) 2016 Intel Deutschland GmbH ++ * Copyright (C) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -2035,6 +2036,8 @@ void ieee80211_remove_interfaces(struct + WARN(local->open_count, "%s: open count remains %d\n", + wiphy_name(local->hw.wiphy), local->open_count); + ++ ieee80211_txq_teardown_flows(local); ++ + mutex_lock(&local->iflist_mtx); + list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) { + list_del(&sdata->list); +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -1200,7 +1200,6 @@ int ieee80211_register_hw(struct ieee802 + rtnl_unlock(); + ieee80211_led_exit(local); + ieee80211_wep_free(local); +- ieee80211_txq_teardown_flows(local); + fail_flows: + destroy_workqueue(local->workqueue); + fail_workqueue: +@@ -1226,7 +1225,6 @@ void ieee80211_unregister_hw(struct ieee + #if IS_ENABLED(__disabled__CONFIG_IPV6) + unregister_inet6addr_notifier(&local->ifa6_notifier); + #endif +- ieee80211_txq_teardown_flows(local); + + rtnl_lock(); + diff --git a/package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch b/package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch new file mode 100644 index 0000000000..d31d45bbdf --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch @@ -0,0 +1,29 @@ +From d350a0f431189517b1af0dbbb605c273231a8966 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Sat, 15 Dec 2018 11:03:22 +0200 +Subject: [PATCH 2/3] nl80211: fix memory leak if validate_pae_over_nl80211() + fails + +If validate_pae_over_nl80211() were to fail in nl80211_crypto_settings(), +we might leak the 'connkeys' allocation. Fix this. + +Fixes: 64bf3d4bc2b0 ("nl80211: Add CONTROL_PORT_OVER_NL80211 attribute") +Signed-off-by: Johannes Berg +--- + net/wireless/nl80211.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -9002,8 +9002,10 @@ static int nl80211_join_ibss(struct sk_b + if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { + int r = validate_pae_over_nl80211(rdev, info); + +- if (r < 0) ++ if (r < 0) { ++ kzfree(connkeys); + return r; ++ } + + ibss.control_port_over_nl80211 = true; + } -- 2.25.1