====================================
From: Dedy Lansky <dlansky@codeaurora.org>
Subject: [PATCH] cfg80211: fix rcu in cfg80211_unregister_wdev
Callers of cfg80211_unregister_wdev can free the wdev object
immediately after this function returns. This may crash the kernel
because this wdev object is still in use by other threads.
Add synchronize_rcu() after list_del_rcu to make sure wdev object can
be safely freed.
Signed-off-by: Dedy Lansky <dlansky@codeaurora.org>
---
net/wireless/core.c | 1 +
1 file changed, 1 insertion(+)
@@ -1012,6 +1012,7 @@ void cfg80211_unregister_wdev(struct wireless_dev
*wdev)
nl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE);
list_del_rcu(&wdev->list);
+ synchronize_rcu();
rdev->devlist_generation++;