mac80211: Run TXQ teardown code before de-registering interfaces
authorToke Høiland-Jørgensen <toke@toke.dk>
Mon, 13 Aug 2018 12:16:25 +0000 (14:16 +0200)
committerJohannes Berg <johannes.berg@intel.com>
Tue, 14 Aug 2018 12:00:07 +0000 (14:00 +0200)
commit77cfaf52eca5cac30ed029507e0cab065f888995
treed11dc2f1e9a73dd1c463a544028845afddffe39d
parentf623f75ae443d0c771635d51cc986b9d389bf631
mac80211: Run TXQ teardown code before de-registering interfaces

The TXQ teardown code can reference the vif data structures that are
stored in the netdev private memory area if there are still packets on
the queue when it is being freed. Since the TXQ teardown code is run
after the netdevs are freed, this can lead to a use-after-free. Fix this
by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().

Reported-by: Ben Greear <greearb@candelatech.com>
Tested-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/mac80211/main.c