releases/4.9.132/mac80211-run-txq-teardown-code-before-de-registering-interfaces.patch

   1 From foo@baz Thu Oct  4 12:38:43 PDT 2018
   2 From: Toke Høiland-Jørgensen <toke@toke.dk>
   3 Date: Mon, 13 Aug 2018 14:16:25 +0200
   4 Subject: mac80211: Run TXQ teardown code before de-registering interfaces
   5
   6 From: Toke Høiland-Jørgensen <toke@toke.dk>
   7
   8 [ Upstream commit 77cfaf52eca5cac30ed029507e0cab065f888995 ]
   9
  10 The TXQ teardown code can reference the vif data structures that are
  11 stored in the netdev private memory area if there are still packets on
  12 the queue when it is being freed. Since the TXQ teardown code is run
  13 after the netdevs are freed, this can lead to a use-after-free. Fix this
  14 by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
  15
  16 Reported-by: Ben Greear <greearb@candelatech.com>
  17 Tested-by: Ben Greear <greearb@candelatech.com>
  18 Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
  19 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  20 Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22 ---
  23  net/mac80211/main.c |    2 +-
  24  1 file changed, 1 insertion(+), 1 deletion(-)
  25
  26 --- a/net/mac80211/main.c
  27 +++ b/net/mac80211/main.c
  28 @@ -1164,6 +1164,7 @@ void ieee80211_unregister_hw(struct ieee
  29  #if IS_ENABLED(CONFIG_IPV6)
  30         unregister_inet6addr_notifier(&local->ifa6_notifier);
  31  #endif
  32 +       ieee80211_txq_teardown_flows(local);
  33
  34         rtnl_lock();
  35
  36 @@ -1191,7 +1192,6 @@ void ieee80211_unregister_hw(struct ieee
  37         skb_queue_purge(&local->skb_queue);
  38         skb_queue_purge(&local->skb_queue_unreliable);
  39         skb_queue_purge(&local->skb_queue_tdls_chsw);
  40 -       ieee80211_txq_teardown_flows(local);
  41
  42         destroy_workqueue(local->workqueue);
  43         wiphy_unregister(local->hw.wiphy);