TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
v4.14.209
twx-linux/net
T
History
Johannes Berg 89ab6b90b7 mac80211: free sta in sta_info_insert_finish() on errors 
commit 7bc40aedf2 upstream.

If sta_info_insert_finish() fails, we currently keep the station
around and free it only in the caller, but there's only one such
caller and it always frees it immediately.

As syzbot found, another consequence of this split is that we can
put things that sleep only into __cleanup_single_sta() and not in
sta_info_free(), but this is the only place that requires such of
sta_info_free() now.

Change this to free the station in sta_info_insert_finish(), in
which case we can still sleep. This will also let us unify the
cleanup code later.

Cc: stable@vger.kernel.org
Fixes: dcd479e10a ("mac80211: always wind down STA state")
Reported-by: syzbot+32c6c38c4812d22f2f0b@syzkaller.appspotmail.com
Reported-by: syzbot+4c81fe92e372d26c4246@syzkaller.appspotmail.com
Reported-by: syzbot+6a7fe9faf0d1d61bc24a@syzkaller.appspotmail.com
Reported-by: syzbot+abed06851c5ffe010921@syzkaller.appspotmail.com
Reported-by: syzbot+b7aeb9318541a1c709f1@syzkaller.appspotmail.com
Reported-by: syzbot+d5a9416c6cafe53b5dd0@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20201112112201.ee6b397b9453.I9c31d667a0ea2151441cc64ed6613d36c18a48e0@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-24 13:05:57 +01:00
..
6lowpan
…
9p
net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid
2020-11-05 11:06:57 +01:00
802
…
8021q
…
appletalk
…
atm
atm: fix a memory leak of vcc->user_back
2020-10-01 13:12:42 +02:00
ax25
AX.25: Prevent integer overflows in connect and sendmsg
2020-07-31 16:44:44 +02:00
batman-adv
batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh
2020-10-01 13:12:51 +02:00
bluetooth
Bluetooth: Only mark socket zapped after unlocking
2020-10-29 09:07:18 +01:00
bpf
…
bridge
net: bridge: add missing counters to ndo_get_stats64 callback
2020-11-24 13:05:38 +01:00
caif
…
can
can: af_can: prevent potential access of uninitialized member in canfd_rcv()
2020-11-24 13:05:47 +01:00
ceph
libceph: clear con->out_msg on Policy::stateful_server faults
2020-11-05 11:07:03 +01:00
core
net: Have netpoll bring-up DSA management interface
2020-11-24 13:05:39 +01:00
dcb
…
dccp
net: ipv6: add net argument to ip6_dst_lookup_flow
2020-05-20 08:17:02 +02:00
decnet
…
dns_resolver
KEYS: Don't write out to userspace while holding key semaphore
2020-04-24 08:01:25 +02:00
dsa
…
ethernet
…
hsr
hsr: check protocol version in hsr_newlink()
2020-04-24 08:00:52 +02:00
ieee802154
…
ife
…
ipv4
tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
2020-11-24 13:05:42 +01:00
ipv6
ah6: fix error return code in ah6_input()
2020-11-24 13:05:35 +01:00
ipx
…
iucv
net/af_iucv: fix null pointer dereference on shutdown
2020-11-18 18:27:59 +01:00
kcm
…
key
af_key: pfkey_dump needs parameter validation
2020-10-01 13:12:23 +02:00
l2tp
l2tp: remove skb_dst_set() from l2tp_xmit_skb()
2020-07-22 09:22:19 +02:00
l3mdev
…
lapb
…
llc
llc: make sure applications use ARPHRD_ETHER
2020-07-22 09:22:20 +02:00
mac80211
mac80211: free sta in sta_info_insert_finish() on errors
2020-11-24 13:05:57 +01:00
mac802154
mac802154: tx: fix use-after-free
2020-10-01 13:12:50 +02:00
mpls
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
2020-05-20 08:17:02 +02:00
ncsi
…
netfilter
ipvs: Fix uninit-value in do_ip_vs_set_ctl()
2020-10-29 09:07:19 +01:00
netlabel
netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
2020-11-24 13:05:40 +01:00
netlink
genetlink: remove genl_bind
2020-07-22 09:22:19 +02:00
netrom
net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
2020-05-02 17:24:17 +02:00
nfc
nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()
2020-10-29 09:06:59 +01:00
nsh
…
openvswitch
openvswitch: handle DNAT tuple collision
2020-10-14 09:51:12 +02:00
packet
net/packet: fix overflow in tpacket_rcv
2020-10-14 09:51:09 +02:00
phonet
…
psample
…
qrtr
net: qrtr: Fix passing invalid reference to qrtr_local_enqueue()
2020-06-03 08:17:38 +02:00
rds
rds: Prevent kernel-infoleak in rds_notify_queue_get()
2020-08-05 10:06:50 +02:00
rfkill
…
rose
…
rxrpc
rxrpc: Fix server keyring leak
2020-10-14 09:51:14 +02:00
sched
net_sched: fix a memory leak in atm_tc_init()
2020-07-22 09:22:20 +02:00
sctp
sctp: change to hold/put transport for proto_unreach_timer
2020-11-24 13:05:41 +01:00
smc
…
strparser
…
sunrpc
svcrdma: Fix leak of transport addresses
2020-10-01 13:12:39 +02:00
switchdev
…
tipc
tipc: fix use-after-free in tipc_bcast_get_mode
2020-11-10 10:29:02 +01:00
tls
…
unix
skbuff: fix a data race in skb_queue_len()
2020-10-01 13:12:33 +02:00
vmw_vsock
vsock: use ns_capable_noaudit() on socket create
2020-11-10 10:29:05 +01:00
wimax
…
wireless
cfg80211: regulatory: Fix inconsistent format argument
2020-11-18 18:27:56 +01:00
x25
net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request
2020-11-24 13:05:40 +01:00
xfrm
net: xfrm: fix a race condition during allocing spi
2020-11-18 18:27:53 +01:00
compat.c
net/compat: Add missing sock updates for SCM_RIGHTS
2020-08-21 09:48:18 +02:00
Kconfig
…
Makefile
…
socket.c
net: Set fput_needed iff FDPUT_FPUT is set
2020-08-21 09:48:14 +02:00
sysctl_net.c
…