mac80211: fix a kernel panic when TXing after TXQ teardown (a50e5fb8) · Commits · 戴 / test

Recently TXQ teardown was moved earlier in ieee80211_unregister_hw(), to avoid a use-after-free of the netdev data. However, interfaces aren't fully removed at the point, and cfg80211_shutdown_all_interfaces can for example, TX a deauth frame. Move the TXQ teardown to the point between cfg80211_shutdown_all_interfaces and the free of netdev queues, so we can be sure they are torn down before netdev is freed, but after there is no ongoing TX. Fixes: ("mac80211: Run TXQ teardown code before de-registering interfaces") Signed-off-by:

Sara Sharon <sara.sharon@intel.com> Signed-off-by:

Luca Coelho <luciano.coelho@intel.com> Signed-off-by:

Johannes Berg <johannes.berg@intel.com>

net/mac80211/iface.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -7,6 +7,7 @@
		* Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
		* Copyright 2013-2014 Intel Mobile Communications GmbH
		* Copyright (c) 2016 Intel Deutschland GmbH
		* Copyright (C) 2018 Intel Corporation
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 as
		@@ -1951,6 +1952,8 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
		WARN(local->open_count, "%s: open count remains %d\n",
		wiphy_name(local->hw.wiphy), local->open_count);

		ieee80211_txq_teardown_flows(local);

		mutex_lock(&local->iflist_mtx);
		list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
		list_del(&sdata->list);

net/mac80211/main.c

+0 −2

Original line number	Diff line number	Diff line
		@@ -1262,7 +1262,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
		rtnl_unlock();
		ieee80211_led_exit(local);
		ieee80211_wep_free(local);
		ieee80211_txq_teardown_flows(local);
		fail_flows:
		destroy_workqueue(local->workqueue);
		fail_workqueue:
		@@ -1288,7 +1287,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
		#if IS_ENABLED(CONFIG_IPV6)
		unregister_inet6addr_notifier(&local->ifa6_notifier);
		#endif
		ieee80211_txq_teardown_flows(local);

		rtnl_lock();

Admin message