summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorDedy Lansky <dlansky@codeaurora.org>2018-06-15 14:05:01 +0300
committerJohannes Berg <johannes@sipsolutions.net>2018-06-15 14:05:14 +0300
commitbf2b61a6838f19cbc33f6732715012c483fa3795 (patch)
tree91aea74e94706907adfdf0c8be7daca9c6f86259 /net
parentdc8b274f0952f604d72b10698cde6887321a669f (diff)
downloadlinux-bf2b61a6838f19cbc33f6732715012c483fa3795.tar.xz
cfg80211: fix rcu in cfg80211_unregister_wdev
Callers of cfg80211_unregister_wdev can free the wdev object immediately after this function returns. This may crash the kernel because this wdev object is still in use by other threads. Add synchronize_rcu() after list_del_rcu to make sure wdev object can be safely freed. Signed-off-by: Dedy Lansky <dlansky@codeaurora.org> Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Diffstat (limited to 'net')
-rw-r--r--net/wireless/core.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 5fe35aafdd9c..48e8097339ab 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1012,6 +1012,7 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev)
nl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE);
list_del_rcu(&wdev->list);
+ synchronize_rcu();
rdev->devlist_generation++;
switch (wdev->iftype) {