[PATCH] wifi: mac80211: mesh: free pending CSA settings on interface stop
Deepanshu Kartikey <[email protected]>
| Newsgroups | org.kernel.vger.linux-wireless,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() and normally freed in ieee80211_mesh_finish_csa() once the channel switch completes. If the mesh interface is stopped while a channel switch is still in progress, ifmsh->csa is never freed, leaking the mesh_csa_settings object. Free it in ieee80211_stop_mesh(), the same way ifmsh->beacon is already handled there. Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=f5752cd6b94fe38be666 Tested-by: [email protected] Signed-off-by: Deepanshu Kartikey <[email protected]> --- net/mac80211/mesh.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c index d4507e4e6ec1..d3fb4478a366 100644 --- a/net/mac80211/mesh.c +++ b/net/mac80211/mesh.c @@ -1201,7 +1201,8 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata) struct ieee80211_local *local = sdata->local; struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; struct beacon_data *bcn; - + struct mesh_csa_settings *csa; + netif_carrier_off(sdata->dev); /* flush STAs and mpaths on this iface */ @@ -1222,6 +1223,13 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata) RCU_INIT_POINTER(ifmsh->beacon, NULL); kfree_rcu(bcn, rcu_head); + /* free any pending, unfinished channel switch */ + csa = sdata_dereference(ifmsh->csa, sdata); + if (csa) { + RCU_INIT_POINTER(ifmsh->csa, NULL); + kfree_rcu(csa, rcu_head); + } + /* free all potentially still buffered group-addressed frames */ local->total_ps_buffered -= skb_queue_len(&ifmsh->ps.bc_buf); skb_queue_purge(&ifmsh->ps.bc_buf); -- 2.34.1