* fix use-after-free in mac80211 TXQs

* fix RX STBC byte order
  * fix debugfs rename crashing due to ERR_PTR()
  * fix missing regulatory notification
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEH1e1rEeCd0AIMq6MB8qZga/fl8QFAlzCyg8ACgkQB8qZga/f
 l8TTzQ//UdRQL5Mt6GfTBrZ/V8gp0+urykENefErjQi7GzUpZC5+bHpm2IGKr6y3
 rf1q3Tr+vAr4WdHxQxjVP0AJIMd5+UAEGgevgMj0yY7Nu9+ktYryhnXrKPBbZRQ+
 mrnZ1u/t6RjA4rCHtEpaW8Xb8FT01VpdtZXbDOaNmGKLLwCbGJb9I9rCfEWczUQ+
 b/a6IFhSE7kxeoceiHXjA7X3eNex/DlV5oE8RCK5gcUtWj8gMzVWNjdiC3gt0VLo
 zLdteEv/C7e+XycWIeHHIWEdScJJFeFNY4e7mvwNIRnil+HrShyrkJUbuHCc/UC/
 USVc/PJX05UTjuAFn1wOdJerUzzQAOYPurZSxuFVl/v2YXjybMYLcCfk1Hplp1v6
 a6nkc/CYGCytHqKteyG9XzkgM3c1rmr8bUDnvJjTxhPh5htlln876VPYnjpEXgGD
 lJgyEgY7M65c3C33dAvilKS3MteZKABXYSCMA+K7mNY5PVcWrC69FYBh9oG4NQQk
 53h+4VxmOBBW4UkZpptbxp4HIHIJCoKR09K9fWuvqGNj1uyexgMY1k6C1g3q2SkA
 PXr+ZGgx5P/DFJsz7U4aqG3mi8vagAUwKEZ6Tt7/BuozrOlwTR/bKoaIZq+Q1Lcu
 SUlyEj18qBZVCKyD2KEveLIGXLjCbHOw0HHB6A4ICEqNcCW6jGE=
 =KjkZ
 -----END PGP SIGNATURE-----

Merge tag 'mac80211-for-davem-2019-04-26' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211

Johannes Berg says:

====================
 * fix use-after-free in mac80211 TXQs
 * fix RX STBC byte order
 * fix debugfs rename crashing due to ERR_PTR()
 * fix missing regulatory notification
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2019-04-29 11:00:58 -04:00
commit 2ae7a39770
4 changed files with 9 additions and 6 deletions

View File

@ -841,7 +841,7 @@ void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
dir = sdata->vif.debugfs_dir;
if (!dir)
if (IS_ERR_OR_NULL(dir))
return;
sprintf(buf, "netdev:%s", sdata->name);

View File

@ -112,8 +112,9 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
IEEE80211_HT_CAP_TX_STBC);
/* Allow user to configure RX STBC bits */
if (ht_capa_mask->cap_info & IEEE80211_HT_CAP_RX_STBC)
ht_cap->cap |= ht_capa->cap_info & IEEE80211_HT_CAP_RX_STBC;
if (ht_capa_mask->cap_info & cpu_to_le16(IEEE80211_HT_CAP_RX_STBC))
ht_cap->cap |= le16_to_cpu(ht_capa->cap_info) &
IEEE80211_HT_CAP_RX_STBC;
/* Allow user to decrease AMPDU factor */
if (ht_capa_mask->ampdu_params_info &

View File

@ -1908,6 +1908,9 @@ void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
list_del_rcu(&sdata->list);
mutex_unlock(&sdata->local->iflist_mtx);
if (sdata->vif.txq)
ieee80211_txq_purge(sdata->local, to_txq_info(sdata->vif.txq));
synchronize_rcu();
if (sdata->dev) {

View File

@ -3778,10 +3778,9 @@ void wiphy_regulatory_register(struct wiphy *wiphy)
/*
* The last request may have been received before this
* registration call. Call the driver notifier if
* initiator is USER and user type is CELL_BASE.
* initiator is USER.
*/
if (lr->initiator == NL80211_REGDOM_SET_BY_USER &&
lr->user_reg_hint_type == NL80211_USER_REG_HINT_CELL_BASE)
if (lr->initiator == NL80211_REGDOM_SET_BY_USER)
reg_call_notifier(wiphy, lr);
}