package/kernel/mac80211/patches/382-mac80211-Run-TXQ-teardown-code-before-de-registering.patch

   1 From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
   2 Date: Mon, 13 Aug 2018 14:16:25 +0200
   3 Subject: [PATCH] mac80211: Run TXQ teardown code before de-registering
   4  interfaces
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 The TXQ teardown code can reference the vif data structures that are
  10 stored in the netdev private memory area if there are still packets on
  11 the queue when it is being freed. Since the TXQ teardown code is run
  12 after the netdevs are freed, this can lead to a use-after-free. Fix this
  13 by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
  14
  15 Reported-by: Ben Greear <greearb@candelatech.com>
  16 Tested-by: Ben Greear <greearb@candelatech.com>
  17 Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  18 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  19 ---
  20
  21 --- a/net/mac80211/main.c
  22 +++ b/net/mac80211/main.c
  23 @@ -1172,6 +1172,7 @@ void ieee80211_unregister_hw(struct ieee
  24  #if IS_ENABLED(__disabled__CONFIG_IPV6)
  25         unregister_inet6addr_notifier(&local->ifa6_notifier);
  26  #endif
  27 +       ieee80211_txq_teardown_flows(local);
  28
  29         rtnl_lock();
  30
  31 @@ -1200,7 +1201,6 @@ void ieee80211_unregister_hw(struct ieee
  32         skb_queue_purge(&local->skb_queue);
  33         skb_queue_purge(&local->skb_queue_unreliable);
  34         skb_queue_purge(&local->skb_queue_tdls_chsw);
  35 -       ieee80211_txq_teardown_flows(local);
  36
  37         destroy_workqueue(local->workqueue);
  38         wiphy_unregister(local->hw.wiphy);