Patch "wifi: mac80211: fix potential sta-link leak" has been added to the 6.7-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    wifi: mac80211: fix potential sta-link leak

to the 6.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wifi-mac80211-fix-potential-sta-link-leak.patch
and it can be found in the queue-6.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit fd2890505f1dd291a5dc74f190d704c71b303d92
Author: Johannes Berg <johannes.berg@xxxxxxxxx>
Date:   Thu Jan 11 18:17:44 2024 +0200

    wifi: mac80211: fix potential sta-link leak
    
    [ Upstream commit b01a74b3ca6fd51b62c67733ba7c3280fa6c5d26 ]
    
    When a station is allocated, links are added but not
    set to valid yet (e.g. during connection to an AP MLD),
    we might remove the station without ever marking links
    valid, and leak them. Fix that.
    
    Fixes: cb71f1d136a6 ("wifi: mac80211: add sta link addition/removal")
    Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
    Reviewed-by: Ilan Peer <ilan.peer@xxxxxxxxx>
    Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@xxxxxxxxx>
    Link: https://msgid.link/20240111181514.6573998beaf8.I09ac2e1d41c80f82a5a616b8bd1d9d8dd709a6a6@changeid
    Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 0ba613dd1cc4..c33decbb97f2 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -404,7 +404,10 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
 	int i;
 
 	for (i = 0; i < ARRAY_SIZE(sta->link); i++) {
-		if (!(sta->sta.valid_links & BIT(i)))
+		struct link_sta_info *link_sta;
+
+		link_sta = rcu_access_pointer(sta->link[i]);
+		if (!link_sta)
 			continue;
 
 		sta_remove_link(sta, i, false);




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux