Commit dcd479e1 authored Oct 09, 2020 by Johannes Berg

mac80211: always wind down STA state



When (for example) an IBSS station is pre-moved to AUTHORIZED
before it's inserted, and then the insertion fails, we don't
clean up the fast RX/TX states that might already have been
created, since we don't go through all the state transitions
again on the way down.

Do that, if it hasn't been done already, when the station is
freed. I considered only freeing the fast TX/RX state there,
but we might add more state so it's more robust to wind down
the state properly.

Note that we warn if the station was ever inserted, it should
have been properly cleaned up in that case, and the driver
will probably not like things happening out of order.

Reported-by:  <syzbot+2e293dbd67de2836ba42@syzkaller.appspotmail.com>
Link: https://lore.kernel.org/r/20201009141710.7223b322a955.I95bd08b9ad0e039c034927cce0b75beea38e059b@changeid


Signed-off-by: Johannes Berg <johannes.berg@intel.com>

parent 9bdaf3b9

net/mac80211/sta_info.c

+18 −0

Original line number	Diff line number	Diff line
		@@ -258,6 +258,24 @@ struct sta_info sta_info_get_by_idx(struct ieee80211_sub_if_data sdata,
		*/
		void sta_info_free(struct ieee80211_local local, struct sta_info sta)
		{
		/*
		* If we had used sta_info_pre_move_state() then we might not
		* have gone through the state transitions down again, so do
		* it here now (and warn if it's inserted).
		*
		* This will clear state such as fast TX/RX that may have been
		* allocated during state transitions.
		*/
		while (sta->sta_state > IEEE80211_STA_NONE) {
		int ret;

		WARN_ON_ONCE(test_sta_flag(sta, WLAN_STA_INSERTED));

		ret = sta_info_move_state(sta, sta->sta_state - 1);
		if (WARN_ONCE(ret, "sta_info_move_state() returned %d\n", ret))
		break;
		}

		if (sta->rate_ctrl)
		rate_control_free_sta(sta);

Admin message