aboutsummaryrefslogtreecommitdiffstats
path: root/package/kernel/mac80211
diff options
context:
space:
mode:
authorKoen Vandeputte <koen.vandeputte@ncentric.com>2018-12-19 11:31:40 +0100
committerKoen Vandeputte <koen.vandeputte@ncentric.com>2018-12-20 14:03:39 +0100
commit4b60ea236eff0703f220774f0fb2413a72ac8902 (patch)
tree4c677a3e2998d58bb2dca5f9604791b26e7527d9 /package/kernel/mac80211
parent62e4395ac712a02409aa72c910276ac8f2f6e723 (diff)
downloadupstream-4b60ea236eff0703f220774f0fb2413a72ac8902.tar.gz
upstream-4b60ea236eff0703f220774f0fb2413a72ac8902.tar.bz2
upstream-4b60ea236eff0703f220774f0fb2413a72ac8902.zip
mac80211: backport upstream fixes
d350a0f43118 nl80211: fix memory leak if validate_pae_over_nl80211() fails a50e5fb8db83 mac80211: fix a kernel panic when TXing after TXQ teardown Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
Diffstat (limited to 'package/kernel/mac80211')
-rw-r--r--package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch60
-rw-r--r--package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch29
2 files changed, 89 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch b/package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch
new file mode 100644
index 0000000000..606897d1fe
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch
@@ -0,0 +1,60 @@
+From a50e5fb8db83c5b57392204c21ea6c5c4ccefde6 Mon Sep 17 00:00:00 2001
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Sat, 15 Dec 2018 11:03:10 +0200
+Subject: [PATCH 1/3] mac80211: fix a kernel panic when TXing after TXQ
+ teardown
+
+Recently TXQ teardown was moved earlier in ieee80211_unregister_hw(),
+to avoid a use-after-free of the netdev data. However, interfaces
+aren't fully removed at the point, and cfg80211_shutdown_all_interfaces
+can for example, TX a deauth frame. Move the TXQ teardown to the
+point between cfg80211_shutdown_all_interfaces and the free of
+netdev queues, so we can be sure they are torn down before netdev
+is freed, but after there is no ongoing TX.
+
+Fixes: 77cfaf52eca5 ("mac80211: Run TXQ teardown code before de-registering interfaces")
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/mac80211/iface.c | 3 +++
+ net/mac80211/main.c | 2 --
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -7,6 +7,7 @@
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2013-2014 Intel Mobile Communications GmbH
+ * Copyright (c) 2016 Intel Deutschland GmbH
++ * Copyright (C) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -2035,6 +2036,8 @@ void ieee80211_remove_interfaces(struct
+ WARN(local->open_count, "%s: open count remains %d\n",
+ wiphy_name(local->hw.wiphy), local->open_count);
+
++ ieee80211_txq_teardown_flows(local);
++
+ mutex_lock(&local->iflist_mtx);
+ list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
+ list_del(&sdata->list);
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1200,7 +1200,6 @@ int ieee80211_register_hw(struct ieee802
+ rtnl_unlock();
+ ieee80211_led_exit(local);
+ ieee80211_wep_free(local);
+- ieee80211_txq_teardown_flows(local);
+ fail_flows:
+ destroy_workqueue(local->workqueue);
+ fail_workqueue:
+@@ -1226,7 +1225,6 @@ void ieee80211_unregister_hw(struct ieee
+ #if IS_ENABLED(__disabled__CONFIG_IPV6)
+ unregister_inet6addr_notifier(&local->ifa6_notifier);
+ #endif
+- ieee80211_txq_teardown_flows(local);
+
+ rtnl_lock();
+
diff --git a/package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch b/package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch
new file mode 100644
index 0000000000..d31d45bbdf
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch
@@ -0,0 +1,29 @@
+From d350a0f431189517b1af0dbbb605c273231a8966 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Sat, 15 Dec 2018 11:03:22 +0200
+Subject: [PATCH 2/3] nl80211: fix memory leak if validate_pae_over_nl80211()
+ fails
+
+If validate_pae_over_nl80211() were to fail in nl80211_crypto_settings(),
+we might leak the 'connkeys' allocation. Fix this.
+
+Fixes: 64bf3d4bc2b0 ("nl80211: Add CONTROL_PORT_OVER_NL80211 attribute")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/wireless/nl80211.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -9002,8 +9002,10 @@ static int nl80211_join_ibss(struct sk_b
+ if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
+ int r = validate_pae_over_nl80211(rdev, info);
+
+- if (r < 0)
++ if (r < 0) {
++ kzfree(connkeys);
+ return r;
++ }
+
+ ibss.control_port_over_nl80211 = true;
+ }