Commit fa28981b authored by Johannes Berg's avatar Johannes Berg
Browse files

wifi: mac80211: fix link data leak 



During the code reshuffling, I accidentally set this to
NULL before using it, fix that to fix the link data leak.

Fixes: d3e2439b ("wifi: mac80211: fix link manipulation")
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent a94c90d3

net/mac80211/iface.c

+10 −10
Original line number Diff line number Diff line
@@ -514,11 +514,7 @@ static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata, 


	/* grab old links to free later */

	for_each_set_bit(link_id, &rem, IEEE80211_MLD_MAX_NUM_LINKS) {

		RCU_INIT_POINTER(sdata->link[link_id], NULL);

		RCU_INIT_POINTER(sdata->vif.link_conf[link_id], NULL);



		if (rcu_access_pointer(sdata->link[link_id]) == &sdata->deflink)

			continue;

		if (rcu_access_pointer(sdata->link[link_id]) != &sdata->deflink) {

			/*

			 * we must have allocated the data through this path so

			 * we know we can free both at the same time
@@ -528,6 +524,10 @@ static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata, 
							data);

		}



		RCU_INIT_POINTER(sdata->link[link_id], NULL);

		RCU_INIT_POINTER(sdata->vif.link_conf[link_id], NULL);

	}



	/* link them into data structures */

	for_each_set_bit(link_id, &add, IEEE80211_MLD_MAX_NUM_LINKS) {

		WARN_ON(!use_deflink &&