linux/net/wireless
Johannes Berg ba392e1355 wifi: cfg80211: clear wdev->cqm_config pointer on free
commit d5fee261df upstream.

When we free wdev->cqm_config when unregistering, we also
need to clear out the pointer since the same wdev/netdev
may get re-registered in another network namespace, then
destroyed later, running this code again, which results in
a double-free.

Reported-by: syzbot+36218cddfd84b5cc263e@syzkaller.appspotmail.com
Fixes: 37c20b2eff ("wifi: cfg80211: fix cqm_config access race")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20241022161742.7c34b2037726.I121b9cdb7eb180802eafc90b493522950d57ee18@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-11-08 16:26:45 +01:00
..
certs wifi: cfg80211: fix certs build to not depend on file order 2024-01-01 12:39:02 +00:00
.gitignore .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
ap.c wifi: cfg80211: do some rework towards MLO link APIs 2022-06-20 12:54:58 +02:00
chan.c wifi: nl80211: relax wdev mutex check in wdev_chandef() 2022-07-01 11:42:58 +02:00
core.c wifi: cfg80211: clear wdev->cqm_config pointer on free 2024-11-08 16:26:45 +01:00
core.h Revert "wifi: cfg80211: check wiphy mutex is held for wdev mutex" 2024-09-30 16:23:55 +02:00
debugfs.c wifi: cfg80211: debugfs: fix return type in ht40allow_map_read() 2022-08-25 10:04:46 +02:00
debugfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ethtool.c wifi: cfg80211: use strscpy to replace strlcpy 2022-07-15 11:43:12 +02:00
ibss.c wifi: cfg80211: Add link_id parameter to various key operations for MLO 2022-08-25 10:41:05 +02:00
Kconfig cfg80211: select CONFIG_CRC32 2021-01-05 15:50:36 -08:00
lib80211.c lib80211: Remove unused macro DRV_NAME 2020-09-18 11:53:00 +02:00
lib80211_crypt_ccmp.c wifi: use struct_group to copy addresses 2022-09-03 16:40:06 +02:00
lib80211_crypt_tkip.c mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
lib80211_crypt_wep.c mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
Makefile cfg80211: fix CONFIG_CFG80211_EXTRA_REGDB_KEYDIR typo 2022-03-01 14:10:14 +01:00
mesh.c wifi: cfg80211: do some rework towards MLO link APIs 2022-06-20 12:54:58 +02:00
mlme.c wifi: cfg80211: reject auth/assoc to AP with our address 2023-09-23 11:11:03 +02:00
nl80211.c genetlink: hold RCU in genlmsg_mcast() 2024-11-01 01:56:00 +01:00
nl80211.h wifi: cfg80211/nl80211: move rx management data into a struct 2022-07-22 14:28:26 +02:00
ocb.c wifi: cfg80211: ocb: don't leave if not joined 2023-09-23 11:11:03 +02:00
of.c cfg80211: support ieee80211-freq-limit DT property 2017-01-06 14:01:13 +01:00
pmsr.c wifi: cfg80211: pmsr: use correct nla_get_uX functions 2024-06-21 14:35:31 +02:00
radiotap.c mac80211: Use flex-array for radiotap header bitmap 2021-08-13 09:58:25 +02:00
rdev-ops.h wifi: cfg80211: fix 6 GHz scan request building 2024-07-25 09:49:09 +02:00
reg.c wifi: cfg80211: fix regulatory disconnect for non-MLO 2023-07-19 16:22:09 +02:00
reg.h cfg80211: avoid holding the RTNL when calling the driver 2021-01-26 11:55:50 +01:00
scan.c wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan() 2024-10-17 15:20:41 +02:00
sme.c wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors 2024-10-17 15:20:41 +02:00
sysfs.c wifi: cfg80211: fully move wiphy work to unbound workqueue 2024-06-21 14:35:31 +02:00
sysfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
trace.c cfg80211: add tracing to rdev-ops 2012-10-18 10:53:37 +02:00
trace.h wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class 2024-06-12 11:02:58 +02:00
util.c wifi: cfg80211: fix receiving mesh packets without RFC1042 header 2024-08-29 17:30:55 +02:00
wext-compat.c wifi: cfg80211: Add link_id parameter to various key operations for MLO 2022-08-25 10:41:05 +02:00
wext-compat.h treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00
wext-core.c wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() 2023-07-27 08:50:35 +02:00
wext-priv.c wext: fix potential private ioctl memory content leak 2010-09-20 13:41:40 -04:00
wext-proc.c proc: introduce proc_create_net{,_data} 2018-05-16 07:24:30 +02:00
wext-sme.c wifi: cfg80211: do some rework towards MLO link APIs 2022-06-20 12:54:58 +02:00
wext-spy.c wireless: wext-spy: Fix out-of-bounds warning 2021-06-23 10:57:17 +02:00