diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2024-01-29 15:53:48 +0100 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2024-02-02 13:09:19 +0100 |
| commit | 9480adfe4e0f0319b9da04b44e4eebd5ad07e0cd (patch) | |
| tree | d136d1544d378732c60704beda3b83fe4ad23b1d | |
| parent | 35e2385dbe787936c793d70755a5177d267a40aa (diff) | |
wifi: mac80211: fix RCU use in TDLS fast-xmit
This looks up the link under RCU protection, but isn't
guaranteed to actually have protection. Fix that.
Fixes: 8cc07265b691 ("wifi: mac80211: handle TDLS data frames with MLO")
Link: https://msgid.link/20240129155348.8a9c0b1e1d89.I553f96ce953bb41b0b877d592056164dec20d01c@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/mac80211/tx.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 68a48abc7287..e448ab338448 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -3100,10 +3100,11 @@ void ieee80211_check_fast_xmit(struct sta_info *sta) /* DA SA BSSID */ build.da_offs = offsetof(struct ieee80211_hdr, addr1); build.sa_offs = offsetof(struct ieee80211_hdr, addr2); + rcu_read_lock(); link = rcu_dereference(sdata->link[tdls_link_id]); - if (WARN_ON_ONCE(!link)) - break; - memcpy(hdr->addr3, link->u.mgd.bssid, ETH_ALEN); + if (!WARN_ON_ONCE(!link)) + memcpy(hdr->addr3, link->u.mgd.bssid, ETH_ALEN); + rcu_read_unlock(); build.hdr_len = 24; break; } |