Commit d5fee261 authored by Johannes Berg's avatar Johannes Berg
Browse files

wifi: cfg80211: clear wdev->cqm_config pointer on free 



When we free wdev->cqm_config when unregistering, we also
need to clear out the pointer since the same wdev/netdev
may get re-registered in another network namespace, then
destroyed later, running this code again, which results in
a double-free.

Reported-by: default avatar <syzbot+36218cddfd84b5cc263e@syzkaller.appspotmail.com>
Fixes: 37c20b2e ("wifi: cfg80211: fix cqm_config access race")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20241022161742.7c34b2037726.I121b9cdb7eb180802eafc90b493522950d57ee18@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 9b15c6cf

net/wireless/core.c

+1 −0
Original line number Diff line number Diff line
@@ -1236,6 +1236,7 @@ static void _cfg80211_unregister_wdev(struct wireless_dev *wdev, 
	/* deleted from the list, so can't be found from nl80211 any more */

	cqm_config = rcu_access_pointer(wdev->cqm_config);

	kfree_rcu(cqm_config, rcu_head);

	RCU_INIT_POINTER(wdev->cqm_config, NULL);



	/*

	 * Ensure that all events have been processed and