Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0a3809bb authored by Dedy Lansky's avatar Dedy Lansky
Browse files

cfg80211: fix rcu in cfg80211_unregister_wdev 



Callers of cfg80211_unregister_wdev can free the wdev object
immediately after this function returns. This may crash the kernel
because this wdev object is still in use by other threads.
Add synchronize_rcu() after list_del_rcu to make sure wdev object can
be safely freed.

Change-Id: Id73921888bed032312b133e94fbfe06537e06b92
Signed-off-by: default avatarDedy Lansky <dlansky@codeaurora.org>
Signed-off-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Git-commit: bf2b61a6
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
parent c426bc6f

net/wireless/core.c

+1 −0
Original line number Diff line number Diff line
@@ -1008,6 +1008,7 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev) 
	nl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE);



	list_del_rcu(&wdev->list);

	synchronize_rcu();

	rdev->devlist_generation++;



	switch (wdev->iftype) {