lkml.org 
[lkml]   [2019]   [Jan]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 056/148] mac80211: fix a kernel panic when TXing after TXQ teardown
    Date
    4.19-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit a50e5fb8db83c5b57392204c21ea6c5c4ccefde6 ]

    Recently TXQ teardown was moved earlier in ieee80211_unregister_hw(),
    to avoid a use-after-free of the netdev data. However, interfaces
    aren't fully removed at the point, and cfg80211_shutdown_all_interfaces
    can for example, TX a deauth frame. Move the TXQ teardown to the
    point between cfg80211_shutdown_all_interfaces and the free of
    netdev queues, so we can be sure they are torn down before netdev
    is freed, but after there is no ongoing TX.

    Fixes: 77cfaf52eca5 ("mac80211: Run TXQ teardown code before de-registering interfaces")
    Signed-off-by: Sara Sharon <sara.sharon@intel.com>
    Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/mac80211/iface.c | 3 +++
    net/mac80211/main.c | 2 --
    2 files changed, 3 insertions(+), 2 deletions(-)

    diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
    index 5f3c81e705c7..3a0171a65db3 100644
    --- a/net/mac80211/iface.c
    +++ b/net/mac80211/iface.c
    @@ -7,6 +7,7 @@
    * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
    * Copyright 2013-2014 Intel Mobile Communications GmbH
    * Copyright (c) 2016 Intel Deutschland GmbH
    + * Copyright (C) 2018 Intel Corporation
    *
    * This program is free software; you can redistribute it and/or modify
    * it under the terms of the GNU General Public License version 2 as
    @@ -1951,6 +1952,8 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
    WARN(local->open_count, "%s: open count remains %d\n",
    wiphy_name(local->hw.wiphy), local->open_count);

    + ieee80211_txq_teardown_flows(local);
    +
    mutex_lock(&local->iflist_mtx);
    list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
    list_del(&sdata->list);
    diff --git a/net/mac80211/main.c b/net/mac80211/main.c
    index 513627896204..68db2a356443 100644
    --- a/net/mac80211/main.c
    +++ b/net/mac80211/main.c
    @@ -1198,7 +1198,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
    rtnl_unlock();
    ieee80211_led_exit(local);
    ieee80211_wep_free(local);
    - ieee80211_txq_teardown_flows(local);
    fail_flows:
    destroy_workqueue(local->workqueue);
    fail_workqueue:
    @@ -1224,7 +1223,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
    #if IS_ENABLED(CONFIG_IPV6)
    unregister_inet6addr_notifier(&local->ifa6_notifier);
    #endif
    - ieee80211_txq_teardown_flows(local);

    rtnl_lock();

    --
    2.19.1


    \
     
     \ /
      Last update: 2019-01-11 15:55    [W:4.271 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site