diff options
| author | Avraham Stern <avraham.stern@intel.com> | 2021-06-18 13:41:31 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-06-23 14:41:30 +0200 |
| commit | 92e08a5ffae9873494c1db6105946558929afec3 (patch) | |
| tree | dfebc91e5e3470af1da84ec7b7abb9de30080ee3 /net | |
| parent | 01ade7c84fdaef1140c77b4bfe843576d4d18f59 (diff) | |
| download | linux-stable-92e08a5ffae9873494c1db6105946558929afec3.tar.gz linux-stable-92e08a5ffae9873494c1db6105946558929afec3.tar.bz2 linux-stable-92e08a5ffae9873494c1db6105946558929afec3.zip | |
cfg80211: avoid double free of PMSR request
commit 0288e5e16a2e18f0b7e61a2b70d9037fc6e4abeb upstream.
If cfg80211_pmsr_process_abort() moves all the PMSR requests that
need to be freed into a local list before aborting and freeing them.
As a result, it is possible that cfg80211_pmsr_complete() will run in
parallel and free the same PMSR request.
Fix it by freeing the request in cfg80211_pmsr_complete() only if it
is still in the original pmsr list.
Cc: stable@vger.kernel.org
Fixes: 9bb7e0f24e7e ("cfg80211: add peer measurement with FTM initiator API")
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210618133832.1fbef57e269a.I00294bebdb0680b892f8d1d5c871fd9dbe785a5e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/wireless/pmsr.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c index c09fbf09549d..0c7bd1f2c55c 100644 --- a/net/wireless/pmsr.c +++ b/net/wireless/pmsr.c @@ -293,6 +293,7 @@ void cfg80211_pmsr_complete(struct wireless_dev *wdev, gfp_t gfp) { struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); + struct cfg80211_pmsr_request *tmp, *prev, *to_free = NULL; struct sk_buff *msg; void *hdr; @@ -323,9 +324,20 @@ free_msg: nlmsg_free(msg); free_request: spin_lock_bh(&wdev->pmsr_lock); - list_del(&req->list); + /* + * cfg80211_pmsr_process_abort() may have already moved this request + * to the free list, and will free it later. In this case, don't free + * it here. + */ + list_for_each_entry_safe(tmp, prev, &wdev->pmsr_list, list) { + if (tmp == req) { + list_del(&req->list); + to_free = req; + break; + } + } spin_unlock_bh(&wdev->pmsr_lock); - kfree(req); + kfree(to_free); } EXPORT_SYMBOL_GPL(cfg80211_pmsr_complete); |