From patchwork Mon Aug 13 12:16:25 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Toke_H=C3=B8iland-J=C3=B8rgensen?= X-Patchwork-Id: 10564109 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 13EC613BB for ; Mon, 13 Aug 2018 12:16:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F3A8A29131 for ; Mon, 13 Aug 2018 12:16:48 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E78FC29134; Mon, 13 Aug 2018 12:16:48 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8A70829131 for ; Mon, 13 Aug 2018 12:16:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729643AbeHMO6s (ORCPT ); Mon, 13 Aug 2018 10:58:48 -0400 Received: from mail.toke.dk ([52.28.52.200]:60725 "EHLO mail.toke.dk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728509AbeHMO6s (ORCPT ); Mon, 13 Aug 2018 10:58:48 -0400 From: =?utf-8?q?Toke_H=C3=B8iland-J=C3=B8rgensen?= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=toke.dk; s=20161023; t=1534162605; bh=0Sd4S5fabdnfl/6c1qCadAphCFnDnLJgNDOcom/lGlU=; h=From:To:Cc:Subject:Date:From; b=cDfve/7z79rcOjiByP08c6AkQkLs78ndiY7DPqruyQU7UrT+8JongqMhWEYdsvVd9 /33n1UEY3AC2gEzkUj+N2/J5c+MYjgXKXoeWIcY4Uf1ZYN4qWYjLw2MKR65ibptNqM PsA/DKW/Jujjp0zNR7Dd7o12l74MhUjw3qA7o59mdLjD1NoOHxi9oJy2yJN4AKVTHC 1XG12tXzJqa42nQ8FZdBhTD4BzdlVWAHmrN+z/uRWRYIs+a4C/VB5HKwQNwIqgxAy5 j+nnDKVYMKS1xwVIMN9QVvUj6UHab9WdUoLKMU0DrGT4KbLy+E1No3z6Ws7ru0HBLd U0e2kkuZDoH6Q== To: linux-wireless@vger.kernel.org Cc: Ben Greear , =?utf-8?q?Toke_H=C3=B8iland-J?= =?utf-8?q?=C3=B8rgensen?= Subject: [PATCH] mac80211: Run TXQ teardown code before de-registering interfaces Date: Mon, 13 Aug 2018 14:16:25 +0200 Message-Id: <20180813121625.18367-1-toke@toke.dk> MIME-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The TXQ teardown code can reference the vif data structures that are stored in the netdev private memory area if there are still packets on the queue when it is being freed. Since the TXQ teardown code is run after the netdevs are freed, this can lead to a use-after-free. Fix this by moving the TXQ teardown code to earlier in ieee80211_unregister_hw(). Reported-by: Ben Greear Tested-by: Ben Greear Signed-off-by: Toke Høiland-Jørgensen --- net/mac80211/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/main.c b/net/mac80211/main.c index e054a2fd8d38..98a5c15e8db1 100644 --- a/net/mac80211/main.c +++ b/net/mac80211/main.c @@ -1170,6 +1170,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw) #if IS_ENABLED(CONFIG_IPV6) unregister_inet6addr_notifier(&local->ifa6_notifier); #endif + ieee80211_txq_teardown_flows(local); rtnl_lock(); @@ -1198,7 +1199,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw) skb_queue_purge(&local->skb_queue); skb_queue_purge(&local->skb_queue_unreliable); skb_queue_purge(&local->skb_queue_tdls_chsw); - ieee80211_txq_teardown_flows(local); destroy_workqueue(local->workqueue); wiphy_unregister(local->hw.wiphy);