Johannes Berg 86f22e7cce wifi: mac80211: fix BA session teardown race ... [ Upstream commit 05f136220d17839eb7c155f015ace9152f603225 ] As previously reported by Alexander, whose commit 69403bad97 ("wifi: mac80211: sdata can be NULL during AMPDU start") I'm reverting as part of this commit, there's a race between station destruction and aggregation setup, where the aggregation setup can happen while the station is being removed and queue the work after ieee80211_sta_tear_down_BA_sessions() has already run in __sta_info_destroy_part1(), and thus the worker will run with a now freed station. In his case, this manifested in a NULL sdata pointer, but really there's no guarantee whatsoever. The real issue seems to be that it's possible at all to have a situation where this occurs - we want to stop the BA sessions when doing _part1, but we cannot be sure, and WLAN_STA_BLOCK_BA isn't necessarily effective since we don't know that the setup isn't concurrently running and already got past the check. Simply call ieee80211_sta_tear_down_BA_sessions() again in the second part of station destruction, since at that point really nothing else can hold a reference to the station any more. Also revert the sdata checks since those are just misleading at this point. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-08-29 17:33:23 +02:00
..
6lowpan	6lowpan: Remove redundant initialisation.	2023-03-29 08:22:52 +01:00
9p	net/9p: fix uninit-value in p9_client_rpc()	2024-06-16 13:47:41 +02:00
802	…
8021q	net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb	2024-05-17 12:02:07 +02:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 17:01:50 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 17:01:48 +01:00
ax25	ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put()	2024-06-21 14:38:14 +02:00
batman-adv	batman-adv: Don't accept TT entries for out-of-spec VIDs	2024-07-05 09:34:04 +02:00
bluetooth	Bluetooth: RFCOMM: Fix not validating setsockopt user input	2024-08-19 06:04:28 +02:00
bpf	bpf: Set run context for rawtp test_run callback	2024-06-21 14:38:16 +02:00
bpfilter	net: Use umd_cleanup_helper()	2023-05-31 13:06:57 +02:00
bridge	netfilter: nf_queue: drop packets with cloned unconfirmed conntracks	2024-08-29 17:33:19 +02:00
caif	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
can	net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new	2024-07-05 09:34:01 +02:00
ceph	libceph: fix race between delayed_work() and ceph_monc_stop()	2024-07-18 13:21:22 +02:00
core	bpf, net: Use DEV_STAT_INC()	2024-08-19 06:04:29 +02:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-01 21:07:46 -07:00
dccp	Fix race for duplicate reqsk on identical SYN	2024-07-05 09:33:48 +02:00
devlink	devlink: fix port new reply cmd type	2024-03-26 18:20:11 -04:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 15:35:41 -08:00
dsa	net: dsa: mark parsed interface mode for legacy switch drivers	2023-08-09 13:08:09 -07:00
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-05-02 16:32:46 +02:00
ethtool	ethtool: netlink: do not return SQI value if link is down	2024-07-18 13:21:14 +02:00
handshake	net/handshake: Fix handshake_req_destroy_test1	2024-02-23 09:24:50 +01:00
hsr	hsr: Simplify code for announcing HSR nodes timer setup	2024-05-17 12:02:24 +02:00
ieee802154	sysctl-6.6-rc1	2023-08-29 17:39:15 -07:00
ife	net: sched: ife: fix potential use-after-free	2024-01-01 12:42:30 +00:00
ipv4	tcp: Update window clamping condition	2024-08-29 17:33:19 +02:00
ipv6	netfilter: allow ipv6 fragments to arrive on different devices	2024-08-29 17:33:19 +02:00
iucv	net/iucv: fix use after free in iucv_sock_close()	2024-08-11 12:47:21 +02:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-26 18:19:40 -04:00
key	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-18 12:44:56 -07:00
l2tp	l2tp: fix lockdep splat	2024-08-14 13:58:40 +02:00
l3mdev	…
lapb	…
llc	llc: call sock_orphan() at release time	2024-02-05 20:14:36 +00:00
mac80211	wifi: mac80211: fix BA session teardown race	2024-08-29 17:33:23 +02:00
mac802154	net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()	2024-07-25 09:50:52 +02:00
mctp	net: mctp: copy skb ext data when fragmenting	2024-03-26 18:19:34 -04:00
mpls	net: mpls: error out if inner headers are not set	2024-04-13 13:07:41 +02:00
mptcp	mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size	2024-08-29 17:33:19 +02:00
ncsi	net/ncsi: Fix the multi thread manner of NCSI driver	2024-06-21 14:38:14 +02:00
netfilter	netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests	2024-08-29 17:33:20 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 15:35:14 -08:00
netlink	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter	2024-03-06 14:48:34 +00:00
netrom	netrom: Fix a memory leak in nr_heartbeat_expiry()	2024-06-27 13:49:06 +02:00
nfc	nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies	2024-08-19 06:04:28 +02:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 12:02:02 +02:00
openvswitch	openvswitch: get related ct labels from its master if it is not confirmed	2024-07-05 09:33:46 +02:00
packet	af_packet: Handle outgoing VLAN packets without hardware offloading	2024-08-03 08:54:13 +02:00
phonet	phonet: fix rtm_phonet_notify() skb allocation	2024-05-17 12:02:22 +02:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:45:10 +01:00
qrtr	net: qrtr: ns: Fix module refcnt	2024-06-12 11:12:12 +02:00
rds	net:rds: Fix possible deadlock in rds_message_put	2024-08-19 06:04:27 +02:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-01 12:42:41 +00:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-01 12:42:31 +00:00
rxrpc	rxrpc: Only transmit one ACK per jumbo packet received	2024-05-17 12:02:23 +02:00
sched	net: don't dump stack on queue timeout	2024-08-19 06:04:26 +02:00
sctp	net: sctp: fix skb leak in sctp_inq_free()	2024-08-19 06:04:27 +02:00
smc	net/smc: add the max value of fallback reason count	2024-08-14 13:58:40 +02:00
strparser	…
sunrpc	sunrpc: use the struct net as the svc proc private	2024-08-19 06:04:23 +02:00
switchdev	net: bridge: switchdev: Skip MDB replays of deferred events on offload	2024-03-01 13:35:06 +01:00
tipc	tipc: Return non-zero value from tipc_udp_addr2str() on error	2024-08-03 08:54:37 +02:00
tls	tls: fix missing memory barrier in tls_init	2024-06-12 11:12:50 +02:00
unix	af_unix: Don't retry after unix_state_lock_nested() in unix_stream_connect().	2024-08-14 13:58:43 +02:00
vmw_vsock	vsock: fix recursive ->recvmsg calls	2024-08-29 17:33:21 +02:00
wireless	wifi: cfg80211: check wiphy mutex is held for wdev mutex	2024-08-29 17:33:23 +02:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:19:41 -04:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-04-17 11:19:28 +02:00
xfrm	xfrm: call xfrm_dev_policy_delete when kill policy	2024-08-03 08:53:42 +02:00
Kconfig	bpf: Add fd-based tcx multi-prog infra with link support	2023-07-19 10:07:27 -07:00
Kconfig.debug	…
Makefile	net/handshake: Create a NETLINK service for handling handshake requests	2023-04-19 18:48:48 -07:00
compat.c	net/compat: Update msg_control_is_user when setting a kernel pointer	2023-04-14 11:09:27 +01:00
devres.c	…
socket.c	net: Save and restore msg_namelen in sock_sendmsg	2024-01-10 17:16:51 +01:00
sysctl_net.c	sysctl: treewide: drop unused argument ctl_table_root::set_ownership(table)	2024-08-11 12:47:13 +02:00