Unverified Commit ba0d233d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14525 CVE-2024-56609 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zicheng Qu <quzicheng@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/VC6OKQFKQB5LO63NBCEDD7FWXBYQIWAZ/ 
CVE-2024-56609

Ping-Ke Shih (2):
  wifi: mac80211: export ieee80211_purge_tx_queue() for drivers
  wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IBEAOM 
 
Link:https://gitee.com/openeuler/kernel/pulls/14525

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 8fdcce9d afcd69e0

drivers/net/wireless/realtek/rtw88/sdio.c

+3 −3
Original line number Diff line number Diff line
@@ -1295,12 +1295,12 @@ static void rtw_sdio_deinit_tx(struct rtw_dev *rtwdev) 
	struct rtw_sdio *rtwsdio = (struct rtw_sdio *)rtwdev->priv;

	int i;



	for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++)

		skb_queue_purge(&rtwsdio->tx_queue[i]);



	flush_workqueue(rtwsdio->txwq);

	destroy_workqueue(rtwsdio->txwq);

	kfree(rtwsdio->tx_handler_data);



	for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++)

		ieee80211_purge_tx_queue(rtwdev->hw, &rtwsdio->tx_queue[i]);

}



int rtw_sdio_probe(struct sdio_func *sdio_func,

drivers/net/wireless/realtek/rtw88/usb.c

+3 −2
Original line number Diff line number Diff line
@@ -416,10 +416,11 @@ static void rtw_usb_tx_handler(struct work_struct *work) 


static void rtw_usb_tx_queue_purge(struct rtw_usb *rtwusb)

{

	struct rtw_dev *rtwdev = rtwusb->rtwdev;

	int i;



	for (i = 0; i < ARRAY_SIZE(rtwusb->tx_queue); i++)

		skb_queue_purge(&rtwusb->tx_queue[i]);

		ieee80211_purge_tx_queue(rtwdev->hw, &rtwusb->tx_queue[i]);

}



static void rtw_usb_write_port_complete(struct urb *urb)
@@ -801,9 +802,9 @@ static void rtw_usb_deinit_tx(struct rtw_dev *rtwdev) 
{

	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);



	rtw_usb_tx_queue_purge(rtwusb);

	flush_workqueue(rtwusb->txwq);

	destroy_workqueue(rtwusb->txwq);

	rtw_usb_tx_queue_purge(rtwusb);

}



static int rtw_usb_intf_init(struct rtw_dev *rtwdev,

include/net/mac80211.h

+13 −0
Original line number Diff line number Diff line
@@ -3039,6 +3039,19 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw, 
 */

void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);



/**

 * ieee80211_purge_tx_queue - purge TX skb queue

 * @hw: the hardware

 * @skbs: the skbs

 *

 * Free a set of transmit skbs. Use this function when device is going to stop

 * but some transmit skbs without TX status are still queued.

 * This function does not take the list lock and the caller must hold the

 * relevant locks to use it.

 */

void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,

			      struct sk_buff_head *skbs);



/**

 * DOC: Hardware crypto acceleration

 *

net/mac80211/ieee80211_i.h

+0 −2
Original line number Diff line number Diff line
@@ -2057,8 +2057,6 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb, 
				  u32 info_flags,

				  u32 ctrl_flags,

				  u64 *cookie);

void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,

			      struct sk_buff_head *skbs);

struct sk_buff *

ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,

			      struct sk_buff *skb, u32 info_flags);

net/mac80211/status.c

+1 −0
Original line number Diff line number Diff line
@@ -1270,3 +1270,4 @@ void ieee80211_purge_tx_queue(struct ieee80211_hw *hw, 
	while ((skb = __skb_dequeue(skbs)))

		ieee80211_free_txskb(hw, skb);

}

EXPORT_SYMBOL(ieee80211_purge_tx_queue);