Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-06 05:02:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

wifi: mac80211: fix RCU use in TDLS fast-xmit

Browse Source 
This looks up the link under RCU protection, but isn't
guaranteed to actually have protection. Fix that.

Fixes: 8cc07265b6 ("wifi: mac80211: handle TDLS data frames with MLO")
Link: https://msgid.link/20240129155348.8a9c0b1e1d89.I553f96ce953bb41b0b877d592056164dec20d01c@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Johannes Berg 2024-01-29 15:53:48 +01:00
parent 35e2385dbe
commit 9480adfe4e
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
net/mac80211/tx.c
View File

@ -3100,10 +3100,11 @@ void ieee80211_check_fast_xmit(struct sta_info *sta)
/* DA SA BSSID */ /* DA SA BSSID */
build.da_offs = offsetof(struct ieee80211_hdr, addr1); build.da_offs = offsetof(struct ieee80211_hdr, addr1);
build.sa_offs = offsetof(struct ieee80211_hdr, addr2); build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
rcu_read_lock();
link = rcu_dereference(sdata->link[tdls_link_id]); link = rcu_dereference(sdata->link[tdls_link_id]);
if (WARN_ON_ONCE(!link)) if (!WARN_ON_ONCE(!link))
break;
memcpy(hdr->addr3, link->u.mgd.bssid, ETH_ALEN); memcpy(hdr->addr3, link->u.mgd.bssid, ETH_ALEN);
rcu_read_unlock();
build.hdr_len = 24; build.hdr_len = 24;
break; break;
} }