Avraham Stern 0288e5e16a cfg80211: avoid double free of PMSR request ...

If cfg80211_pmsr_process_abort() moves all the PMSR requests that
need to be freed into a local list before aborting and freeing them.
As a result, it is possible that cfg80211_pmsr_complete() will run in
parallel and free the same PMSR request.

Fix it by freeing the request in cfg80211_pmsr_complete() only if it
is still in the original pmsr list.

Cc: stable@vger.kernel.org
Fixes: 9bb7e0f24e ("cfg80211: add peer measurement with FTM initiator API")
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210618133832.1fbef57e269a.I00294bebdb0680b892f8d1d5c871fd9dbe785a5e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

2021-06-18 13:25:24 +02:00

..

certs

…

.gitignore

…

ap.c

…

chan.c

cfg80211: avoid holding the RTNL when calling the driver

2021-01-26 11:55:50 +01:00

core.c

cfg80211: fix phy80211 symlink creation

2021-06-09 16:09:20 +02:00

core.h

cfg80211: avoid holding the RTNL when calling the driver

2021-01-26 11:55:50 +01:00

debugfs.c

cfg80211: avoid holding the RTNL when calling the driver

2021-01-26 11:55:50 +01:00

debugfs.h

…

ethtool.c

…

ibss.c

cfg80211: avoid holding the RTNL when calling the driver

2021-01-26 11:55:50 +01:00

Kconfig

…

lib80211_crypt_ccmp.c

…

lib80211_crypt_tkip.c

…

lib80211_crypt_wep.c

…

lib80211.c

…

Makefile

cfg80211: make certificate generation more robust

2021-06-18 13:25:15 +02:00

mesh.c

…

mlme.c

cfg80211: avoid holding the RTNL when calling the driver

2021-01-26 11:55:50 +01:00

nl80211.c

Merge tag 'net-next-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2021-04-29 11:57:23 -07:00

nl80211.h

…

ocb.c

…

of.c

…

pmsr.c

cfg80211: avoid double free of PMSR request

2021-06-18 13:25:24 +02:00

radiotap.c

…

rdev-ops.h

…

reg.c

cfg80211: regulatory: use DEFINE_SPINLOCK() for spinlock

2021-04-08 10:17:32 +02:00

reg.h

cfg80211: avoid holding the RTNL when calling the driver

2021-01-26 11:55:50 +01:00

scan.c

Merge tag 'mac80211-next-for-net-next-2021-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

2021-04-20 16:44:04 -07:00

sme.c

cfg80211: remove WARN_ON() in cfg80211_sme_connect

2021-04-08 10:14:55 +02:00

sysfs.c

cfg80211: shut down interfaces on failed resume

2021-06-09 16:09:20 +02:00

sysfs.h

…

trace.c

…

trace.h

…

util.c

cfg80211: call cfg80211_leave_ocb when switching away from OCB

2021-05-31 21:27:15 +02:00

wext-compat.c

wext: call cfg80211_set_encryption() with wiphy lock held

2021-01-28 19:10:57 +01:00

wext-compat.h

…

wext-core.c

wext: fix NULL-ptr-dereference with cfg80211's lack of commit()

2021-01-26 11:59:42 +01:00

wext-priv.c

…

wext-proc.c

…

wext-sme.c

cfg80211: avoid holding the RTNL when calling the driver

2021-01-26 11:55:50 +01:00

wext-spy.c

…