From: Toke Høiland-Jørgensen Date: Mon, 13 Aug 2018 12:16:25 +0000 (+0200) Subject: mac80211: Run TXQ teardown code before de-registering interfaces X-Git-Tag: v4.19~241^2~4^2~21 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=77cfaf52eca5cac30ed029507e0cab065f888995;p=platform%2Fkernel%2Flinux-rpi.git mac80211: Run TXQ teardown code before de-registering interfaces The TXQ teardown code can reference the vif data structures that are stored in the netdev private memory area if there are still packets on the queue when it is being freed. Since the TXQ teardown code is run after the netdevs are freed, this can lead to a use-after-free. Fix this by moving the TXQ teardown code to earlier in ieee80211_unregister_hw(). Reported-by: Ben Greear Tested-by: Ben Greear Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: Johannes Berg --- diff --git a/net/mac80211/main.c b/net/mac80211/main.c index fb73451..0358f20 100644 --- a/net/mac80211/main.c +++ b/net/mac80211/main.c @@ -1182,6 +1182,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw) #if IS_ENABLED(CONFIG_IPV6) unregister_inet6addr_notifier(&local->ifa6_notifier); #endif + ieee80211_txq_teardown_flows(local); rtnl_lock(); @@ -1210,7 +1211,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw) skb_queue_purge(&local->skb_queue); skb_queue_purge(&local->skb_queue_unreliable); skb_queue_purge(&local->skb_queue_tdls_chsw); - ieee80211_txq_teardown_flows(local); destroy_workqueue(local->workqueue); wiphy_unregister(local->hw.wiphy);