lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 240/862] wifi: mac80211: fix use-after-free
    Date
    From: Johannes Berg <johannes.berg@intel.com>

    [ Upstream commit 40fb87129049ec5876dabf4a4d4aed6642b31f1a ]

    We've already freed the assoc_data at this point, so need
    to use another copy of the AP (MLD) address instead.

    Fixes: 81151ce462e5 ("wifi: mac80211: support MLO authentication/association with one link")
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/mac80211/mlme.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
    index fc764984d687..1e9cb4be6ed3 100644
    --- a/net/mac80211/mlme.c
    +++ b/net/mac80211/mlme.c
    @@ -5122,7 +5122,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
    resp.req_ies = ifmgd->assoc_req_ies;
    resp.req_ies_len = ifmgd->assoc_req_ies_len;
    if (sdata->vif.valid_links)
    - resp.ap_mld_addr = assoc_data->ap_addr;
    + resp.ap_mld_addr = sdata->vif.cfg.ap_addr;
    cfg80211_rx_assoc_resp(sdata->dev, &resp);
    notify_driver:
    drv_mgd_complete_tx(sdata->local, sdata, &info);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-19 15:58    [W:2.216 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site