| From 08d56e619dbfa4c98af169caa9acd43367a11826 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 17 May 2021 17:04:31 +0200 |
| Subject: mac80211_hwsim: drop pending frames on stop |
| |
| From: Johannes Berg <johannes.berg@intel.com> |
| |
| [ Upstream commit bd18de517923903a177508fc8813f44e717b1c00 ] |
| |
| Syzbot reports that we may be able to get into a situation where |
| mac80211 has pending ACK frames on shutdown with hwsim. It appears |
| that the reason for this is that syzbot uses the wmediumd hooks to |
| intercept/injection frames, and may shut down hwsim, removing the |
| radio(s), while frames are pending in the air simulation. |
| |
| Clean out the pending queue when the interface is stopped, after |
| this the frames can't be reported back to mac80211 properly anyway. |
| |
| Reported-by: syzbot+a063bbf0b15737362592@syzkaller.appspotmail.com |
| Link: https://lore.kernel.org/r/20210517170429.b0f85ab0eda1.Ie42a6ec6b940c971f3441286aeaaae2fe368e29a@changeid |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/wireless/mac80211_hwsim.c | 5 +++++ |
| 1 file changed, 5 insertions(+) |
| |
| diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c |
| index fa7d4c20dc13..30b39cb4056a 100644 |
| --- a/drivers/net/wireless/mac80211_hwsim.c |
| +++ b/drivers/net/wireless/mac80211_hwsim.c |
| @@ -1693,8 +1693,13 @@ static int mac80211_hwsim_start(struct ieee80211_hw *hw) |
| static void mac80211_hwsim_stop(struct ieee80211_hw *hw) |
| { |
| struct mac80211_hwsim_data *data = hw->priv; |
| + |
| data->started = false; |
| hrtimer_cancel(&data->beacon_timer); |
| + |
| + while (!skb_queue_empty(&data->pending)) |
| + ieee80211_free_txskb(hw, skb_dequeue(&data->pending)); |
| + |
| wiphy_dbg(hw->wiphy, "%s\n", __func__); |
| } |
| |
| -- |
| 2.30.2 |
| |
