Commit bf2b61a6 authored by Dedy Lansky's avatar Dedy Lansky Committed by Johannes Berg

cfg80211: fix rcu in cfg80211_unregister_wdev

Callers of cfg80211_unregister_wdev can free the wdev object
immediately after this function returns. This may crash the kernel
because this wdev object is still in use by other threads.
Add synchronize_rcu() after list_del_rcu to make sure wdev object can
be safely freed.
Signed-off-by: default avatarDedy Lansky <dlansky@codeaurora.org>
Signed-off-by: default avatarJohannes Berg <johannes@sipsolutions.net>
parent dc8b274f
...@@ -1012,6 +1012,7 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev) ...@@ -1012,6 +1012,7 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev)
nl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE); nl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE);
list_del_rcu(&wdev->list); list_del_rcu(&wdev->list);
synchronize_rcu();
rdev->devlist_generation++; rdev->devlist_generation++;
switch (wdev->iftype) { switch (wdev->iftype) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment