diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2022-06-01 10:19:36 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-06-14 19:11:44 +0300 |
| commit | 265bec4779a38b65e86a25120370f200822dfa76 (patch) | |
| tree | 5dfffd6bd3a02d25038b7f3a2100e0901ab9d085 /net | |
| parent | 9259227605df41996b088c17b70c1698e6ea558c (diff) | |
| download | linux-265bec4779a38b65e86a25120370f200822dfa76.tar.xz | |
wifi: mac80211: fix use-after-free in chanctx code
commit 2965c4cdf7ad9ce0796fac5e57debb9519ea721e upstream.
In ieee80211_vif_use_reserved_context(), when we have an
old context and the new context's replace_state is set to
IEEE80211_CHANCTX_REPLACE_NONE, we free the old context
in ieee80211_vif_use_reserved_reassign(). Therefore, we
cannot check the old_ctx anymore, so we should set it to
NULL after this point.
However, since the new_ctx replace state is clearly not
IEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do
anything else in this function and can just return to
avoid accessing the freed old_ctx.
Cc: stable@vger.kernel.org
Fixes: 5bcae31d9cb1 ("mac80211: implement multi-vif in-place reservations")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220601091926.df419d91b165.I17a9b3894ff0b8323ce2afdb153b101124c821e5@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mac80211/chan.c | 7 |
1 files changed, 2 insertions, 5 deletions
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c index 9c94baaf693c..15f47918cbac 100644 --- a/net/mac80211/chan.c +++ b/net/mac80211/chan.c @@ -1639,12 +1639,9 @@ int ieee80211_vif_use_reserved_context(struct ieee80211_sub_if_data *sdata) if (new_ctx->replace_state == IEEE80211_CHANCTX_REPLACE_NONE) { if (old_ctx) - err = ieee80211_vif_use_reserved_reassign(sdata); - else - err = ieee80211_vif_use_reserved_assign(sdata); + return ieee80211_vif_use_reserved_reassign(sdata); - if (err) - return err; + return ieee80211_vif_use_reserved_assign(sdata); } /* |