Johannes Berg 499b109be6 mac80211: free sta in sta_info_insert_finish() on errors ...

commit 7bc40aedf2 upstream.

If sta_info_insert_finish() fails, we currently keep the station
around and free it only in the caller, but there's only one such
caller and it always frees it immediately.

As syzbot found, another consequence of this split is that we can
put things that sleep only into __cleanup_single_sta() and not in
sta_info_free(), but this is the only place that requires such of
sta_info_free() now.

Change this to free the station in sta_info_insert_finish(), in
which case we can still sleep. This will also let us unify the
cleanup code later.

Cc: stable@vger.kernel.org
Fixes: dcd479e10a ("mac80211: always wind down STA state")
Reported-by: syzbot+32c6c38c4812d22f2f0b@syzkaller.appspotmail.com
Reported-by: syzbot+4c81fe92e372d26c4246@syzkaller.appspotmail.com
Reported-by: syzbot+6a7fe9faf0d1d61bc24a@syzkaller.appspotmail.com
Reported-by: syzbot+abed06851c5ffe010921@syzkaller.appspotmail.com
Reported-by: syzbot+b7aeb9318541a1c709f1@syzkaller.appspotmail.com
Reported-by: syzbot+d5a9416c6cafe53b5dd0@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20201112112201.ee6b397b9453.I9c31d667a0ea2151441cc64ed6613d36c18a48e0@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2020-11-24 13:27:26 +01:00

..

6lowpan

…

9p

net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid

2020-11-05 11:08:44 +01:00

802

…

8021q

…

appletalk

…

atm

atm: fix a memory leak of vcc->user_back

2020-10-01 13:14:43 +02:00

ax25

…

batman-adv

batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh

2020-10-01 13:14:52 +02:00

bluetooth

Bluetooth: Only mark socket zapped after unlocking

2020-10-30 10:38:30 +01:00

bpf

…

bpfilter

…

bridge

net: bridge: add missing counters to ndo_get_stats64 callback

2020-11-24 13:27:17 +01:00

caif

…

can

can: af_can: prevent potential access of uninitialized member in canfd_rcv()

2020-11-24 13:27:22 +01:00

ceph

libceph: clear con->out_msg on Policy::stateful_server faults

2020-11-05 11:08:53 +01:00

core

net: Have netpoll bring-up DSA management interface

2020-11-24 13:27:17 +01:00

dcb

net: DCB: Validate DCB_ATTR_DCB_BUFFER argument

2020-09-26 18:01:29 +02:00

dccp

…

decnet

…

dns_resolver

…

dsa

net: dsa: read mac address from DT for slave device

2020-11-10 12:36:02 +01:00

ethernet

…

hsr

…

ieee802154

…

ife

…

ipv4

tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate

2020-11-24 13:27:18 +01:00

ipv6

ah6: fix error return code in ah6_input()

2020-11-24 13:27:15 +01:00

iucv

net/af_iucv: fix null pointer dereference on shutdown

2020-11-18 19:18:51 +01:00

kcm

…

key

af_key: pfkey_dump needs parameter validation

2020-09-26 18:01:28 +02:00

l2tp

…

l3mdev

…

lapb

…

llc

net: silence data-races on sk_backlog.tail

2020-10-01 13:14:26 +02:00

mac80211

mac80211: free sta in sta_info_insert_finish() on errors

2020-11-24 13:27:26 +01:00

mac802154

mac802154: tx: fix use-after-free

2020-10-01 13:14:51 +02:00

mpls

…

ncsi

net/ncsi: Fix netlink registration

2020-11-24 13:27:19 +01:00

netfilter

netfilter: use actual socket sk rather than skb sk when routing harder

2020-11-18 19:18:44 +01:00

netlabel

netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()

2020-11-24 13:27:17 +01:00

netlink

…

netrom

…

nfc

nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()

2020-10-29 09:54:58 +01:00

nsh

…

openvswitch

openvswitch: handle DNAT tuple collision

2020-10-14 10:31:24 +02:00

packet

net/packet: fix overflow in tpacket_rcv

2020-10-07 08:00:08 +02:00

phonet

…

psample

…

qrtr

net: qrtr: check skb_put_padto() return value

2020-09-26 18:01:30 +02:00

rds

…

rfkill

…

rose

…

rxrpc

rxrpc: Fix server keyring leak

2020-10-14 10:31:26 +02:00

sched

net: sch_generic: fix the missing new qdisc assignment bug

2020-11-18 19:18:53 +01:00

sctp

sctp: change to hold/put transport for proto_unreach_timer

2020-11-24 13:27:18 +01:00

smc

net/smc: fix valid DMBE buffer sizes

2020-10-29 09:54:55 +01:00

strparser

…

sunrpc

SUNRPC: fix copying of multiple pages in gss_read_proxy_verf()

2020-10-30 10:38:23 +01:00

switchdev

…

tipc

tipc: fix memory leak in tipc_topsrv_start()

2020-11-18 19:18:51 +01:00

tls

net/tls: sendfile fails with ktls offload

2020-10-29 09:54:56 +01:00

unix

skbuff: fix a data race in skb_queue_len()

2020-10-01 13:14:32 +02:00

vmw_vsock

vsock: use ns_capable_noaudit() on socket create

2020-11-10 12:35:59 +01:00

wimax

…

wireless

cfg80211: regulatory: Fix inconsistent format argument

2020-11-18 19:18:45 +01:00

x25

net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request

2020-11-24 13:27:18 +01:00

xdp

…

xfrm

net: xfrm: fix a race condition during allocing spi

2020-11-18 19:18:41 +01:00

compat.c

…

Kconfig

…

Makefile

…

socket.c

…

sysctl_net.c

…