mac80211_hwsim: fix race in radio destruction from netlink notifier

Browse source

The asynchronous destruction from a work-queue of radios tagged with
destroy-on-close may race with the owning namespace about to exit,
resulting in potential use-after-free of that namespace.

Instead of using a work-queue, move radios about to destroy to a
temporary list, which can be worked on synchronously after releasing
the lock. This should be safe to do from the netlink socket notifier,
as the namespace is guaranteed to not get released.

Signed-off-by: Martin Willi <martin@strongswan.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

...

This commit is contained in:

Martin Willi 2018-09-25 09:41:14 +02:00 • committed by Johannes Berg

parent 628980e5c8

commit f1c47eb61d

1 changed files with 9 additions and 13 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

22

drivers/net/wireless/mac80211_hwsim.c

View file