kernel/linux.git/drivers/net/wireless/mac80211_hwsim.c, branch linux-4.16.y

mac80211_hwsim: fix use-after-free bug in hwsim_exit_net

2018-04-26T09:00:39+00:00

commit 8cfd36a0b53aeb4ec21d81eb79706697b84dfc3d upstream. When destroying a net namespace, all hwsim interfaces, which are not created in default namespace are deleted. But the async deletion of the interfaces could last longer than the actual destruction of the namespace, which results to an use after free bug. Therefore use synchronous deletion in this case. Fixes: 100cb9ff40e0 ("mac80211_hwsim: Allow managing radios from non-initial namespaces") Reported-by: syzbot+70ce058e01259de7bb1d@syzkaller.appspotmail.com Signed-off-by: Benjamin Beichler Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman

mac80211_hwsim: Set wmediumd for new radios

2018-03-21T12:01:54+00:00

Set the wmediumd to the net's wmediumd when the radio gets created. Radios created after HWSIM_CMD_REGISTER don't currently get their data->wmediumd set and the userspace would need to reconnect to netlink to be able to call HWSIM_CMD_REGISTER again. Alternatively I think data->netgroup and data->wmedium could be replaced with a pointer to hwsim_net. Signed-off-by: Andrew Zaborowski Signed-off-by: Johannes Berg

Merge tag 'mac80211-for-davem-2018-02-22' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211

2018-02-22T20:17:01+00:00

Johannes Berg says: ==================== Various fixes across the tree, the shortlog basically says it all: cfg80211: fix cfg80211_beacon_dup -> old bug in this code cfg80211: clear wep keys after disconnection -> certain ways of disconnecting left the keys mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4 -> alignment issues with using 14 bytes mac80211: Do not disconnect on invalid operating class -> if the AP has a bogus operating class, let it be mac80211: Fix sending ADDBA response for an ongoing session -> don't send the same frame twice cfg80211: use only 1Mbps for basic rates in mesh -> interop issue with old versions of our code mac80211_hwsim: don't use WQ_MEM_RECLAIM -> it causes splats because it flushes work on a non-reclaim WQ regulatory: add NUL to request alpha2 -> nla_put_string() issue from Kees mac80211: mesh: fix wrong mesh TTL offset calculation -> protocol issue mac80211: fix a possible leak of station stats -> error path might leak memory mac80211: fix calling sleeping function in atomic context -> percpu allocations need to be made with gfp flags ==================== Signed-off-by: David S. Miller

mac80211_hwsim: don't use WQ_MEM_RECLAIM

2018-02-19T12:13:10+00:00

We're obviously not part of a memory reclaim path, so don't set the flag. This also causes a warning in check_flush_dependency() since we end up in a code path that flushes a non-reclaim workqueue, and we shouldn't do that if we were really part of reclaim. Reported-by: syzbot+41cdaf4232c50e658934@syzkaller.appspotmail.com Signed-off-by: Johannes Berg

Merge tag 'mac80211-next-for-davem-2018-01-22' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

2018-01-22T14:36:37+00:00

Johannes Berg says: ==================== Less than a handful of changes: * possible memory leak fix in hwsim * speed up hwsim * add hwsim userspace rate control API * code cleanups ==================== A conflict was resolved in mac80211_hwsim.c, mostly of the simple overlapping changes category. One adding a rhashtable and another adding a workqueue. Signed-off-by: David S. Miller

mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl()

2018-01-22T13:03:29+00:00

'hwname' is malloced in hwsim_new_radio_nl() and should be freed before leaving from the error handling cases, otherwise it will cause memory leak. Fixes: ff4dd73dd2b4 ("mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length") Signed-off-by: Wei Yongjun Reviewed-by: Ben Hutchings Signed-off-by: Johannes Berg

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-01-17T05:10:42+00:00

Overlapping changes all over. The mini-qdisc bits were a little bit tricky, however. Signed-off-by: David S. Miller

mac80211_hwsim: add hwsim_tx_rate_flags to netlink attributes

2018-01-15T12:18:42+00:00

For correct interpretation of a tx rate, the corresponding rate flags are needed (e.g. whether a HT-MCS rate or a legacy rate) and moreover for more correct simulation the other infos of the flags are important (like short-GI). Keeping compatibility, the flags are not integrated into the existing hwsim_tx_rate, but transmitted as an additional netlink attribute. Signed-off-by: Benjamin Beichler Signed-off-by: Johannes Berg

mac80211_hwsim: add hashtable with mac address keys for faster lookup

2018-01-15T11:39:20+00:00

This patch adds a rhastable for mac address lookup of hwsim radios. This especially improve the speed on reception of a netlink message with a new frame. Although redundant, we keep holding a normal list for all radios, since the rhashtable_walk interface adds a lot of overhead for iterating over all radios and the doc of rhashtable recommend a redundant structure for stable walks in such situations. Since rhashtable is rcu protected we do not need a lock for delivering frames and thus improving this scenario. Signed-off-by: Benjamin Beichler [remove hash function, it would cause alignment issues] Signed-off-by: Johannes Berg

mac80211_hwsim: validate number of different channels

2018-01-15T08:34:45+00:00

When creating a new radio on the fly, hwsim allows this to be done with an arbitrary number of channels, but cfg80211 only supports a limited number of simultaneous channels, leading to a warning. Fix this by validating the number - this requires moving the define for the maximum out to a visible header file. Reported-by: syzbot+8dd9051ff19940290931@syzkaller.appspotmail.com Fixes: b59ec8dd4394 ("mac80211_hwsim: fix number of channels in interface combinations") Signed-off-by: Johannes Berg