On Tue, 2023-08-15 at 15:37 +0200, Johannes Berg wrote:
>
>
> - err = cfg80211_cqm_rssi_update(rdev, dev);
> + err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
> + if (err) {
> + rcu_assign_pointer(wdev->cqm_config, old);
> + kfree(cqm_config);
OK, that's wrong wrt. RCU handling, maybe that causes heap corruption if
someone sees wdev->cqm_config under RCU but it was freed and re-
allocated.
I think I'll just remove this failure path handling change entirely and
do it separately.
johannes
