Commit 77cfaf52 authored Aug 13, 2018 by Toke Høiland-Jørgensen Committed by Johannes Berg Aug 14, 2018

mac80211: Run TXQ teardown code before de-registering interfaces

The TXQ teardown code can reference the vif data structures that are
stored in the netdev private memory area if there are still packets on
the queue when it is being freed. Since the TXQ teardown code is run
after the netdevs are freed, this can lead to a use-after-free. Fix this
by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().

Reported-by: Ben Greear <greearb@candelatech.com>
Tested-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

parent f623f75a

net/mac80211/main.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1182,6 +1182,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
		#if IS_ENABLED(CONFIG_IPV6)
		unregister_inet6addr_notifier(&local->ifa6_notifier);
		#endif
		ieee80211_txq_teardown_flows(local);

		rtnl_lock();

		@@ -1210,7 +1211,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
		skb_queue_purge(&local->skb_queue);
		skb_queue_purge(&local->skb_queue_unreliable);
		skb_queue_purge(&local->skb_queue_tdls_chsw);
		ieee80211_txq_teardown_flows(local);

		destroy_workqueue(local->workqueue);
		wiphy_unregister(local->hw.wiphy);