lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 16 May 2019 07:41:57 -0400
From:   Sasha Levin <>
Cc:     Bhagavathi Perumal S <>,
        Toke Høiland-Jørgensen <>,
        Johannes Berg <>,
        Sasha Levin <>,,
Subject: [PATCH AUTOSEL 3.18 4/6] mac80211: Fix kernel panic due to use of txq after free

From: Bhagavathi Perumal S <>

[ Upstream commit f1267cf3c01b12e0f843fb6a7450a7f0b2efab8a ]

The txq of vif is added to active_txqs list for ATF TXQ scheduling
in the function ieee80211_queue_skb(), but it was not properly removed
before freeing the txq object. It was causing use after free of the txq
objects from the active_txqs list, result was kernel panic
due to invalid memory access.

Fix kernel invalid memory access by properly removing txq object
from active_txqs list before free the object.

Signed-off-by: Bhagavathi Perumal S <>
Acked-by: Toke Høiland-Jørgensen <>
Signed-off-by: Johannes Berg <>
Signed-off-by: Sasha Levin <>
 net/mac80211/iface.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index f4ce34670fa83..e052c11d8900a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1764,6 +1764,9 @@ void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
+	if (sdata->vif.txq)
+		ieee80211_txq_purge(sdata->local, to_txq_info(sdata->vif.txq));
 	if (sdata->dev) {

Powered by blists - more mailing lists