Johannes Berg 499b109be6 mac80211: free sta in sta_info_insert_finish() on errors ... commit 7bc40aedf2 upstream. If sta_info_insert_finish() fails, we currently keep the station around and free it only in the caller, but there's only one such caller and it always frees it immediately. As syzbot found, another consequence of this split is that we can put things that sleep only into __cleanup_single_sta() and not in sta_info_free(), but this is the only place that requires such of sta_info_free() now. Change this to free the station in sta_info_insert_finish(), in which case we can still sleep. This will also let us unify the cleanup code later. Cc: stable@vger.kernel.org Fixes: dcd479e10a ("mac80211: always wind down STA state") Reported-by: syzbot+32c6c38c4812d22f2f0b@syzkaller.appspotmail.com Reported-by: syzbot+4c81fe92e372d26c4246@syzkaller.appspotmail.com Reported-by: syzbot+6a7fe9faf0d1d61bc24a@syzkaller.appspotmail.com Reported-by: syzbot+abed06851c5ffe010921@syzkaller.appspotmail.com Reported-by: syzbot+b7aeb9318541a1c709f1@syzkaller.appspotmail.com Reported-by: syzbot+d5a9416c6cafe53b5dd0@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20201112112201.ee6b397b9453.I9c31d667a0ea2151441cc64ed6613d36c18a48e0@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-11-24 13:27:26 +01:00
..
6lowpan	6lowpan: Off by one handling ->nexthdr	2020-01-27 14:50:41 +01:00
9p	net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid	2020-11-05 11:08:44 +01:00
802
8021q	vlan: vlan_changelink() should propagate errors	2020-01-12 12:17:28 +01:00
appletalk	appletalk: Set error code if register_snap_client failed	2019-12-13 08:52:59 +01:00
atm	atm: fix a memory leak of vcc->user_back	2020-10-01 13:14:43 +02:00
ax25	AX.25: Prevent integer overflows in connect and sendmsg	2020-07-31 18:37:48 +02:00
batman-adv	batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh	2020-10-01 13:14:52 +02:00
bluetooth	Bluetooth: Only mark socket zapped after unlocking	2020-10-30 10:38:30 +01:00
bpf	bpf/test_run: support cgroup local storage	2018-08-03 00:47:32 +02:00
bpfilter	signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig	2020-01-27 14:50:51 +01:00
bridge	net: bridge: add missing counters to ndo_get_stats64 callback	2020-11-24 13:27:17 +01:00
caif	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
can	can: af_can: prevent potential access of uninitialized member in canfd_rcv()	2020-11-24 13:27:22 +01:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-11-05 11:08:53 +01:00
core	net: Have netpoll bring-up DSA management interface	2020-11-24 13:27:17 +01:00
dcb	net: DCB: Validate DCB_ATTR_DCB_BUFFER argument	2020-09-26 18:01:29 +02:00
dccp	net: ipv6: add net argument to ip6_dst_lookup_flow	2020-04-29 16:31:16 +02:00
decnet	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2020-01-04 19:13:37 +01:00
dns_resolver	KEYS: Don't write out to userspace while holding key semaphore	2020-04-23 10:30:24 +02:00
dsa	net: dsa: read mac address from DT for slave device	2020-11-10 12:36:02 +01:00
ethernet	net: add annotations on hh->hh_len lockless accesses	2020-01-09 10:19:09 +01:00
hsr	hsr: check protocol version in hsr_newlink()	2020-04-21 09:03:03 +02:00
ieee802154	nl802154: add missing attribute validation for dev_type	2020-03-18 07:14:15 +01:00
ife	net: sched: ife: check on metadata length	2018-04-22 21:12:00 -04:00
ipv4	tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate	2020-11-24 13:27:18 +01:00
ipv6	ah6: fix error return code in ah6_input()	2020-11-24 13:27:15 +01:00
iucv	net/af_iucv: fix null pointer dereference on shutdown	2020-11-18 19:18:51 +01:00
kcm	kcm: switch order of device registration to fix a crash	2019-04-17 08:38:40 +02:00
key	af_key: pfkey_dump needs parameter validation	2020-09-26 18:01:28 +02:00
l2tp	l2tp: remove skb_dst_set() from l2tp_xmit_skb()	2020-07-22 09:31:59 +02:00
l3mdev
lapb	lapb: fixed leak of control-blocks.	2019-06-22 08:15:13 +02:00
llc	net: silence data-races on sk_backlog.tail	2020-10-01 13:14:26 +02:00
mac80211	mac80211: free sta in sta_info_insert_finish() on errors	2020-11-24 13:27:26 +01:00
mac802154	mac802154: tx: fix use-after-free	2020-10-01 13:14:51 +02:00
mpls	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2020-04-29 16:31:17 +02:00
ncsi	net/ncsi: Fix netlink registration	2020-11-24 13:27:19 +01:00
netfilter	netfilter: use actual socket sk rather than skb sk when routing harder	2020-11-18 19:18:44 +01:00
netlabel	netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()	2020-11-24 13:27:17 +01:00
netlink	genetlink: remove genl_bind	2020-07-22 09:31:58 +02:00
netrom	net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node	2020-04-29 16:31:21 +02:00
nfc	nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()	2020-10-29 09:54:58 +01:00
nsh	nsh: set mac len based on inner packet	2018-07-12 16:55:29 -07:00
openvswitch	openvswitch: handle DNAT tuple collision	2020-10-14 10:31:24 +02:00
packet	net/packet: fix overflow in tpacket_rcv	2020-10-07 08:00:08 +02:00
phonet	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
psample	net: psample: fix skb_over_panic	2019-12-05 09:21:30 +01:00
qrtr	net: qrtr: check skb_put_padto() return value	2020-09-26 18:01:30 +02:00
rds	rds: Prevent kernel-infoleak in rds_notify_queue_get()	2020-08-05 10:06:01 +02:00
rfkill	rfkill: Fix incorrect check to avoid NULL pointer dereference	2020-01-12 12:17:17 +01:00
rose	net/rose: fix unbound loop in rose_loopback_timer()	2019-05-02 09:59:00 +02:00
rxrpc	rxrpc: Fix server keyring leak	2020-10-14 10:31:26 +02:00
sched	net: sch_generic: fix the missing new qdisc assignment bug	2020-11-18 19:18:53 +01:00
sctp	sctp: change to hold/put transport for proto_unreach_timer	2020-11-24 13:27:18 +01:00
smc	net/smc: fix valid DMBE buffer sizes	2020-10-29 09:54:55 +01:00
strparser	net: strparser: partially revert "strparser: Call skb_unclone conditionally"	2019-05-16 19:41:27 +02:00
sunrpc	SUNRPC: fix copying of multiple pages in gss_read_proxy_verf()	2020-10-30 10:38:23 +01:00
switchdev
tipc	tipc: fix memory leak in tipc_topsrv_start()	2020-11-18 19:18:51 +01:00
tls	net/tls: sendfile fails with ktls offload	2020-10-29 09:54:56 +01:00
unix	skbuff: fix a data race in skb_queue_len()	2020-10-01 13:14:32 +02:00
vmw_vsock	vsock: use ns_capable_noaudit() on socket create	2020-11-10 12:35:59 +01:00
wimax	wimax: remove blank lines at EOF	2018-07-24 14:10:42 -07:00
wireless	cfg80211: regulatory: Fix inconsistent format argument	2020-11-18 19:18:45 +01:00
x25	net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request	2020-11-24 13:27:18 +01:00
xdp	xdp: Fix xsk_generic_xmit errno	2020-06-25 15:33:05 +02:00
xfrm	net: xfrm: fix a race condition during allocing spi	2020-11-18 19:18:41 +01:00
compat.c	net/compat: Add missing sock updates for SCM_RIGHTS	2020-08-21 11:05:32 +02:00
Kconfig	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
Makefile	bpfilter: check compiler capability in Kconfig	2018-06-28 13:36:39 +09:00
socket.c	net: Set fput_needed iff FDPUT_FPUT is set	2020-08-19 08:15:03 +02:00
sysctl_net.c	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00