lkml.org 
[lkml]   [2021]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 136/154] cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
    Date
    From: Nguyen Dinh Phi <phind.uet@gmail.com>

    commit 563fbefed46ae4c1f70cffb8eb54c02df480b2c2 upstream.

    If the userspace tools switch from NL80211_IFTYPE_P2P_GO to
    NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), it
    does not call the cleanup cfg80211_stop_ap(), this leads to the
    initialization of in-use data. For example, this path re-init the
    sdata->assigned_chanctx_list while it is still an element of
    assigned_vifs list, and makes that linked list corrupt.

    Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
    Reported-by: syzbot+bbf402b783eeb6d908db@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/r/20211027173722.777287-1-phind.uet@gmail.com
    Cc: stable@vger.kernel.org
    Fixes: ac800140c20e ("cfg80211: .stop_ap when interface is going down")
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/wireless/util.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/net/wireless/util.c
    +++ b/net/wireless/util.c
    @@ -1044,6 +1044,7 @@ int cfg80211_change_iface(struct cfg8021

    switch (otype) {
    case NL80211_IFTYPE_AP:
    + case NL80211_IFTYPE_P2P_GO:
    cfg80211_stop_ap(rdev, dev, true);
    break;
    case NL80211_IFTYPE_ADHOC:

    \
     
     \ /
      Last update: 2021-11-24 14:41    [W:2.266 / U:0.208 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site