4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Toke H�iland-J�rgensen" toke@toke.dk
[ Upstream commit 77cfaf52eca5cac30ed029507e0cab065f888995 ]
The TXQ teardown code can reference the vif data structures that are stored in the netdev private memory area if there are still packets on the queue when it is being freed. Since the TXQ teardown code is run after the netdevs are freed, this can lead to a use-after-free. Fix this by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
Reported-by: Ben Greear greearb@candelatech.com Tested-by: Ben Greear greearb@candelatech.com Signed-off-by: Toke Høiland-Jørgensen toke@toke.dk Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Sasha Levin alexander.levin@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- net/mac80211/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/mac80211/main.c +++ b/net/mac80211/main.c @@ -1171,6 +1171,7 @@ void ieee80211_unregister_hw(struct ieee #if IS_ENABLED(CONFIG_IPV6) unregister_inet6addr_notifier(&local->ifa6_notifier); #endif + ieee80211_txq_teardown_flows(local);
rtnl_lock();
@@ -1199,7 +1200,6 @@ void ieee80211_unregister_hw(struct ieee skb_queue_purge(&local->skb_queue); skb_queue_purge(&local->skb_queue_unreliable); skb_queue_purge(&local->skb_queue_tdls_chsw); - ieee80211_txq_teardown_flows(local);
destroy_workqueue(local->workqueue); wiphy_unregister(local->hw.wiphy);