lkml.org 
[lkml]   [2021]   [Jun]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.12 027/110] mac80211_hwsim: drop pending frames on stop
    Date
    From: Johannes Berg <johannes.berg@intel.com>

    [ Upstream commit bd18de517923903a177508fc8813f44e717b1c00 ]

    Syzbot reports that we may be able to get into a situation where
    mac80211 has pending ACK frames on shutdown with hwsim. It appears
    that the reason for this is that syzbot uses the wmediumd hooks to
    intercept/injection frames, and may shut down hwsim, removing the
    radio(s), while frames are pending in the air simulation.

    Clean out the pending queue when the interface is stopped, after
    this the frames can't be reported back to mac80211 properly anyway.

    Reported-by: syzbot+a063bbf0b15737362592@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/r/20210517170429.b0f85ab0eda1.Ie42a6ec6b940c971f3441286aeaaae2fe368e29a@changeid
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/mac80211_hwsim.c | 5 +++++
    1 file changed, 5 insertions(+)

    diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
    index fa7d4c20dc13..30b39cb4056a 100644
    --- a/drivers/net/wireless/mac80211_hwsim.c
    +++ b/drivers/net/wireless/mac80211_hwsim.c
    @@ -1693,8 +1693,13 @@ static int mac80211_hwsim_start(struct ieee80211_hw *hw)
    static void mac80211_hwsim_stop(struct ieee80211_hw *hw)
    {
    struct mac80211_hwsim_data *data = hw->priv;
    +
    data->started = false;
    hrtimer_cancel(&data->beacon_timer);
    +
    + while (!skb_queue_empty(&data->pending))
    + ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
    +
    wiphy_dbg(hw->wiphy, "%s\n", __func__);
    }

    --
    2.30.2
    \
     
     \ /
      Last update: 2021-06-28 16:21    [W:4.073 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site