Commit 9480adfe authored by Johannes Berg's avatar Johannes Berg
Browse files

wifi: mac80211: fix RCU use in TDLS fast-xmit 

This looks up the link under RCU protection, but isn't
guaranteed to actually have protection. Fix that.

Fixes: 8cc07265 ("wifi: mac80211: handle TDLS data frames with MLO")
Link: https://msgid.link/20240129155348.8a9c0b1e1d89.I553f96ce953bb41b0b877d592056164dec20d01c@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 35e2385d

net/mac80211/tx.c

+4 −3
Original line number Diff line number Diff line
@@ -3100,10 +3100,11 @@ void ieee80211_check_fast_xmit(struct sta_info *sta) 
			/* DA SA BSSID */

			build.da_offs = offsetof(struct ieee80211_hdr, addr1);

			build.sa_offs = offsetof(struct ieee80211_hdr, addr2);

			rcu_read_lock();

			link = rcu_dereference(sdata->link[tdls_link_id]);

			if (WARN_ON_ONCE(!link))

				break;

			if (!WARN_ON_ONCE(!link))

				memcpy(hdr->addr3, link->u.mgd.bssid, ETH_ALEN);

			rcu_read_unlock();

			build.hdr_len = 24;

			break;

		}