Commit 54e4ffb2 authored by Johannes Berg's avatar Johannes Berg Committed by John W. Linville

mac80211: fix auth/assoc data & timer leak

When removing an interface while it is in the
process of authenticating or associating, we
leak the auth_data or assoc_data, and leave
the timer pending. The timer then crashes the
system when it fires as its data is gone.

Fix this by explicitly deleting all the data
when the interface is removed. This uncovered
another bug -- this problem should have been
detected by the sta_info_flush() warning but
that function doesn't ever return non-zero,
I'll fix that in a separate patch.
Reported-by: default avatarHieu Nguyen <hieux.c.nguyen@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent fda82417
...@@ -1178,6 +1178,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, ...@@ -1178,6 +1178,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
struct sk_buff *skb); struct sk_buff *skb);
void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata); void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata);
void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata); void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata);
void ieee80211_mgd_teardown(struct ieee80211_sub_if_data *sdata);
/* IBSS code */ /* IBSS code */
void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local); void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
......
...@@ -644,6 +644,8 @@ static void ieee80211_teardown_sdata(struct net_device *dev) ...@@ -644,6 +644,8 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
if (ieee80211_vif_is_mesh(&sdata->vif)) if (ieee80211_vif_is_mesh(&sdata->vif))
mesh_rmc_free(sdata); mesh_rmc_free(sdata);
else if (sdata->vif.type == NL80211_IFTYPE_STATION)
ieee80211_mgd_teardown(sdata);
flushed = sta_info_flush(local, sdata); flushed = sta_info_flush(local, sdata);
WARN_ON(flushed); WARN_ON(flushed);
......
...@@ -3513,6 +3513,19 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata, ...@@ -3513,6 +3513,19 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
return 0; return 0;
} }
void ieee80211_mgd_teardown(struct ieee80211_sub_if_data *sdata)
{
struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
mutex_lock(&ifmgd->mtx);
if (ifmgd->assoc_data)
ieee80211_destroy_assoc_data(sdata, false);
if (ifmgd->auth_data)
ieee80211_destroy_auth_data(sdata, false);
del_timer_sync(&ifmgd->timer);
mutex_unlock(&ifmgd->mtx);
}
void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif, void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
enum nl80211_cqm_rssi_threshold_event rssi_event, enum nl80211_cqm_rssi_threshold_event rssi_event,
gfp_t gfp) gfp_t gfp)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment