From: Johannes Berg <johannes@sipsolutions.net>
To: linux-wireless@vger.kernel.org
Cc: Johannes Berg <johannes.berg@intel.com>
Subject: [PATCH 4/8] mac80211: fix mgmt-tx abort cookie and leak
Date: Thu, 26 Nov 2015 11:57:44 +0100 [thread overview]
Message-ID: <1448535468-12237-4-git-send-email-johannes@sipsolutions.net> (raw)
In-Reply-To: <1448535468-12237-1-git-send-email-johannes@sipsolutions.net>
From: Johannes Berg <johannes.berg@intel.com>
If a mgmt-tx operation is aborted before it runs, the wrong
cookie is reported back to userspace, and the ack_skb gets
leaked since the frame is freed directly instead of freeing
it using ieee80211_free_txskb(). Fix that.
Fixes: 3b79af973cf4 ("mac80211: stop using pointers as userspace cookies")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
net/mac80211/offchannel.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 04401037140e..0fe9f746cd7e 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -308,11 +308,10 @@ void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free)
/* was never transmitted */
if (roc->frame) {
- cfg80211_mgmt_tx_status(&roc->sdata->wdev,
- (unsigned long)roc->frame,
+ cfg80211_mgmt_tx_status(&roc->sdata->wdev, roc->mgmt_tx_cookie,
roc->frame->data, roc->frame->len,
false, GFP_KERNEL);
- kfree_skb(roc->frame);
+ ieee80211_free_txskb(&roc->sdata->local->hw, roc->frame);
}
if (!roc->mgmt_tx_cookie)
--
2.6.2
next prev parent reply other threads:[~2015-11-26 10:57 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-26 10:57 [PATCH 1/8] mac80211: properly free skb when r-o-c for TX fails Johannes Berg
2015-11-26 10:57 ` [PATCH 2/8] mac80211: properly free TX skbs when monitor " Johannes Berg
2015-11-26 10:57 ` [PATCH 3/8] mac80211: catch queue stop underflow Johannes Berg
2015-11-26 10:57 ` Johannes Berg [this message]
2015-11-26 10:57 ` [PATCH 5/8] mac80211: move off-channel/mgmt-tx code to offchannel.oc Johannes Berg
2015-11-26 10:57 ` [PATCH 6/8] mac80211: simplify ack_skb handling Johannes Berg
2015-11-26 10:57 ` [PATCH 7/8] mac80211_hwsim: delay hardware remain-on-channel start Johannes Berg
2015-11-26 10:57 ` [PATCH 8/8] mac80211: rewrite remain-on-channel logic Johannes Berg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1448535468-12237-4-git-send-email-johannes@sipsolutions.net \
--to=johannes@sipsolutions.net \
--cc=johannes.berg@intel.com \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).