TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
v4.9.246
twx-linux/net
T
History
Johannes Berg 38eeb13581 mac80211: free sta in sta_info_insert_finish() on errors 
commit 7bc40aedf2 upstream.

If sta_info_insert_finish() fails, we currently keep the station
around and free it only in the caller, but there's only one such
caller and it always frees it immediately.

As syzbot found, another consequence of this split is that we can
put things that sleep only into __cleanup_single_sta() and not in
sta_info_free(), but this is the only place that requires such of
sta_info_free() now.

Change this to free the station in sta_info_insert_finish(), in
which case we can still sleep. This will also let us unify the
cleanup code later.

Cc: stable@vger.kernel.org
Fixes: dcd479e10a ("mac80211: always wind down STA state")
Reported-by: syzbot+32c6c38c4812d22f2f0b@syzkaller.appspotmail.com
Reported-by: syzbot+4c81fe92e372d26c4246@syzkaller.appspotmail.com
Reported-by: syzbot+6a7fe9faf0d1d61bc24a@syzkaller.appspotmail.com
Reported-by: syzbot+abed06851c5ffe010921@syzkaller.appspotmail.com
Reported-by: syzbot+b7aeb9318541a1c709f1@syzkaller.appspotmail.com
Reported-by: syzbot+d5a9416c6cafe53b5dd0@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20201112112201.ee6b397b9453.I9c31d667a0ea2151441cc64ed6613d36c18a48e0@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-24 13:03:09 +01:00
..
6lowpan
6lowpan: Off by one handling ->nexthdr
2020-01-29 10:24:22 +01:00
9p
net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid
2020-11-10 10:23:54 +01:00
802
…
8021q
vlan: fix memory leak in vlan_dev_set_egress_priority
2020-01-12 11:24:27 +01:00
appletalk
appletalk: Set error code if register_snap_client failed
2019-12-21 10:41:45 +01:00
atm
atm: fix a memory leak of vcc->user_back
2020-10-01 20:40:12 +02:00
ax25
AX.25: Prevent integer overflows in connect and sendmsg
2020-07-31 16:44:06 +02:00
batman-adv
batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh
2020-10-01 20:40:18 +02:00
bluetooth
Bluetooth: Only mark socket zapped after unlocking
2020-10-29 09:05:44 +01:00
bridge
net: bridge: add missing counters to ndo_get_stats64 callback
2020-11-24 13:02:55 +01:00
caif
…
can
can: purge socket error queue on sock destruct
2019-07-10 09:55:33 +02:00
ceph
libceph: clear con->out_msg on Policy::stateful_server faults
2020-11-10 10:23:59 +01:00
core
net: Have netpoll bring-up DSA management interface
2020-11-24 13:02:55 +01:00
dcb
…
dccp
net: ipv6: add net argument to ip6_dst_lookup_flow
2020-05-20 08:15:30 +02:00
decnet
decnet: fix DN_IFREQ_SIZE
2019-12-05 15:35:12 +01:00
dns_resolver
…
dsa
net: dsa: tag_brcm: Fix skb->fwd_offload_mark location
2020-04-13 10:32:53 +02:00
ethernet
net: add annotations on hh->hh_len lockless accesses
2020-01-12 11:24:19 +01:00
hsr
net/hsr: Check skb_put_padto() return value
2020-10-01 20:40:01 +02:00
ieee802154
nl802154: add missing attribute validation for dev_type
2020-03-20 09:07:39 +01:00
ipv4
tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
2020-11-24 13:02:59 +01:00
ipv6
ah6: fix error return code in ah6_input()
2020-11-24 13:02:52 +01:00
ipx
…
irda
…
iucv
net/af_iucv: fix null pointer dereference on shutdown
2020-11-18 18:26:29 +01:00
kcm
…
key
af_key: pfkey_dump needs parameter validation
2020-10-01 20:39:59 +02:00
l2tp
l2tp: remove skb_dst_set() from l2tp_xmit_skb()
2020-07-22 09:10:47 +02:00
l3mdev
…
lapb
lapb: fixed leak of control-blocks.
2019-06-22 08:17:22 +02:00
llc
llc: make sure applications use ARPHRD_ETHER
2020-07-22 09:10:47 +02:00
mac80211
mac80211: free sta in sta_info_insert_finish() on errors
2020-11-24 13:03:09 +01:00
mac802154
mac802154: tx: fix use-after-free
2020-10-01 20:40:18 +02:00
mpls
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
2020-05-20 08:15:30 +02:00
ncsi
…
netfilter
ipvs: Fix uninit-value in do_ip_vs_set_ctl()
2020-10-29 09:05:45 +01:00
netlabel
netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
2020-11-24 13:02:56 +01:00
netlink
genetlink: remove genl_bind
2020-07-22 09:10:48 +02:00
netrom
net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
2020-05-02 17:23:08 +02:00
nfc
nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()
2020-10-29 09:05:32 +01:00
openvswitch
openvswitch: handle DNAT tuple collision
2020-10-14 09:48:16 +02:00
packet
net/packet: fix overflow in tpacket_rcv
2020-10-14 09:48:13 +02:00
phonet
…
qrtr
net: qrtr: Fix passing invalid reference to qrtr_local_enqueue()
2020-06-03 08:16:29 +02:00
rds
rds: Prevent kernel-infoleak in rds_notify_queue_get()
2020-08-21 11:01:49 +02:00
rfkill
rfkill: Fix incorrect check to avoid NULL pointer dereference
2020-01-12 11:24:23 +01:00
rose
…
rxrpc
rxrpc: Fix server keyring leak
2020-10-14 09:48:17 +02:00
sched
net: sched: export __netdev_watchdog_up()
2020-06-30 15:38:37 -04:00
sctp
sctp: change to hold/put transport for proto_unreach_timer
2020-11-24 13:02:58 +01:00
strparser
…
sunrpc
SUNRPC: ECONNREFUSED should cause a rebind.
2020-11-10 10:23:50 +01:00
switchdev
…
tipc
tipc: fix use-after-free in tipc_bcast_get_mode
2020-11-10 10:24:01 +01:00
unix
skbuff: fix a data race in skb_queue_len()
2020-10-01 20:40:06 +02:00
vmw_vsock
vsock: use ns_capable_noaudit() on socket create
2020-11-10 10:24:03 +01:00
wimax
…
wireless
cfg80211: regulatory: Fix inconsistent format argument
2020-11-18 18:26:26 +01:00
x25
net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request
2020-11-24 13:02:57 +01:00
xfrm
net: xfrm: fix a race condition during allocing spi
2020-11-18 18:26:23 +01:00
compat.c
net/compat: Add missing sock updates for SCM_RIGHTS
2020-08-21 11:02:08 +02:00
Kconfig
…
Makefile
…
socket.c
net: Set fput_needed iff FDPUT_FPUT is set
2020-08-21 11:02:04 +02:00
sysctl_net.c
…