diff options
Diffstat (limited to 'package/kernel/mac80211/patches/subsys/360-mac80211-fix-a-memory-leak-where-sta_info-is-not-fre.patch')
| -rw-r--r-- | package/kernel/mac80211/patches/subsys/360-mac80211-fix-a-memory-leak-where-sta_info-is-not-fre.patch | 77 |
1 files changed, 0 insertions, 77 deletions
diff --git a/package/kernel/mac80211/patches/subsys/360-mac80211-fix-a-memory-leak-where-sta_info-is-not-fre.patch b/package/kernel/mac80211/patches/subsys/360-mac80211-fix-a-memory-leak-where-sta_info-is-not-fre.patch deleted file mode 100644 index ff3cb7be53..0000000000 --- a/package/kernel/mac80211/patches/subsys/360-mac80211-fix-a-memory-leak-where-sta_info-is-not-fre.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 4db561ae4a90c2d0e15996634567559e292dc9e5 Mon Sep 17 00:00:00 2001 -From: Ahmed Zaki <anzaki@gmail.com> -Date: Sat, 2 Oct 2021 08:53:29 -0600 -Subject: [PATCH] mac80211: fix a memory leak where sta_info is not freed - -commit 8f9dcc29566626f683843ccac6113a12208315ca upstream. - -The following is from a system that went OOM due to a memory leak: - -wlan0: Allocated STA 74:83:c2:64:0b:87 -wlan0: Allocated STA 74:83:c2:64:0b:87 -wlan0: IBSS finish 74:83:c2:64:0b:87 (---from ieee80211_ibss_add_sta) -wlan0: Adding new IBSS station 74:83:c2:64:0b:87 -wlan0: moving STA 74:83:c2:64:0b:87 to state 2 -wlan0: moving STA 74:83:c2:64:0b:87 to state 3 -wlan0: Inserted STA 74:83:c2:64:0b:87 -wlan0: IBSS finish 74:83:c2:64:0b:87 (---from ieee80211_ibss_work) -wlan0: Adding new IBSS station 74:83:c2:64:0b:87 -wlan0: moving STA 74:83:c2:64:0b:87 to state 2 -wlan0: moving STA 74:83:c2:64:0b:87 to state 3 -. -. -wlan0: expiring inactive not authorized STA 74:83:c2:64:0b:87 -wlan0: moving STA 74:83:c2:64:0b:87 to state 2 -wlan0: moving STA 74:83:c2:64:0b:87 to state 1 -wlan0: Removed STA 74:83:c2:64:0b:87 -wlan0: Destroyed STA 74:83:c2:64:0b:87 - -The ieee80211_ibss_finish_sta() is called twice on the same STA from 2 -different locations. On the second attempt, the allocated STA is not -destroyed creating a kernel memory leak. - -This is happening because sta_info_insert_finish() does not call -sta_info_free() the second time when the STA already exists (returns --EEXIST). Note that the caller sta_info_insert_rcu() assumes STA is -destroyed upon errors. - -Same fix is applied to -ENOMEM. - -Signed-off-by: Ahmed Zaki <anzaki@gmail.com> -Link: https://lore.kernel.org/r/20211002145329.3125293-1-anzaki@gmail.com -[change the error path label to use the existing code] -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Viacheslav Sablin <sablin@ispras.ru> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - net/mac80211/sta_info.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -646,13 +646,13 @@ static int sta_info_insert_finish(struct - /* check if STA exists already */ - if (sta_info_get_bss(sdata, sta->sta.addr)) { - err = -EEXIST; -- goto out_err; -+ goto out_cleanup; - } - - sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL); - if (!sinfo) { - err = -ENOMEM; -- goto out_err; -+ goto out_cleanup; - } - - local->num_sta++; -@@ -708,8 +708,8 @@ static int sta_info_insert_finish(struct - out_drop_sta: - local->num_sta--; - synchronize_net(); -+ out_cleanup: - cleanup_single_sta(sta); -- out_err: - mutex_unlock(&local->sta_mtx); - kfree(sinfo); - rcu_read_lock(); |