On 8/13/2018 2:16 PM, Toke Høiland-Jørgensen wrote:
The TXQ teardown code can reference the vif data structures that are stored in the netdev private memory area if there are still packets on the queue when it is being freed. Since the TXQ teardown code is run after the netdevs are freed, this can lead to a use-after-free. Fix this by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
Just off the bat, but from reading the above I am wondering whether the use-after-free could also happen upon removing an interface?
Regards, Arend
Reported-by: Ben Greear <greearb@xxxxxxxxxxxxxxx> Tested-by: Ben Greear <greearb@xxxxxxxxxxxxxxx> Signed-off-by: Toke Høiland-Jørgensen <toke@xxxxxxx> --- net/mac80211/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
