If wiphy_register fails or does not get called, which leads to
that, ieee80211_register_hw returns with an error. Then the error
handling code of mac80211_hwsim_new_radio does not free wiphy->regd.
Note that, the free stack trace of wiphy->regd is as follows:
ieee80211_unregister_hw()
-> wiphy_unregister()
-> wiphy_regulatory_deregister()
-> rcu_free_regdom()
Fix this by moving the free operation of regd from wiphy_unregister to
wiphy_free.
Reported-by: [email protected]
Fixes: 3e0c3ff36c4c ("cfg80211: allow multiple driver regulatory_hints()")
Signed-off-by: Dongliang Mu <[email protected]>
---
net/wireless/core.c | 3 +++
net/wireless/reg.c | 9 +++++----
net/wireless/reg.h | 1 +
3 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 03323121ca50..2cc2bdddc9e8 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1085,6 +1085,9 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev)
void wiphy_free(struct wiphy *wiphy)
{
+ rcu_free_regdom(get_wiphy_regdom(wiphy));
+ RCU_INIT_POINTER(wiphy->regd, NULL);
+
put_device(&wiphy->dev);
}
EXPORT_SYMBOL(wiphy_free);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index c2d0ff7f089f..246f882e0021 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -196,12 +196,16 @@ enum nl80211_dfs_regions reg_get_dfs_region(struct wiphy *wiphy)
return regd->dfs_region;
}
-static void rcu_free_regdom(const struct ieee80211_regdomain *r)
+/*
+ * Free the regulatory domain associated with the wiphy
+ */
+void rcu_free_regdom(const struct ieee80211_regdomain *r)
{
if (!r)
return;
kfree_rcu((struct ieee80211_regdomain *)r, rcu_head);
}
+EXPORT_SYMBOL(rcu_free_regdom);
static struct regulatory_request *get_last_request(void)
{
@@ -4064,9 +4068,6 @@ void wiphy_regulatory_deregister(struct wiphy *wiphy)
if (!reg_dev_ignore_cell_hint(wiphy))
reg_num_devs_support_basehint--;
- rcu_free_regdom(get_wiphy_regdom(wiphy));
- RCU_INIT_POINTER(wiphy->regd, NULL);
-
if (lr)
request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index f3707f729024..03de4e5ece85 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -32,6 +32,7 @@ bool reg_is_valid_request(const char *alpha2);
bool is_world_regdom(const char *alpha2);
bool reg_supported_dfs_region(enum nl80211_dfs_regions dfs_region);
enum nl80211_dfs_regions reg_get_dfs_region(struct wiphy *wiphy);
+void rcu_free_regdom(const struct ieee80211_regdomain *r);
int regulatory_hint_user(const char *alpha2,
enum nl80211_user_reg_hint_type user_reg_hint_type);
--
2.25.1