samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wifi: mac80211: finish link init before RCU publish

Browse Source 
[ Upstream commit d87c3ca0f8f1ca4c25f2ed819e954952f4d8d709 ]

Since the link/conf pointers can be accessed without any
protection other than RCU, make sure the data is actually
set up before publishing the structures.

Fixes: b2e8434f18 ("wifi: mac80211: set up/tear down client vif links properly")
Link: https://patch.msgid.link/20250624130749.9a308b713c74.I4a80f5eead112a38730939ea591d2e275c721256@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Johannes Berg
2025-06-24 13:07:49 +02:00
committed by Greg Kroah-Hartman
parent ebca4264c6
commit 6310aafd42
1 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
net/mac80211/link.c
View File

@@ -28,8 +28,16 @@ void ieee80211_link_init(struct ieee80211_sub_if_data *sdata,
if (link_id < 0) if (link_id < 0)
link_id = 0; link_id = 0;
rcu_assign_pointer(sdata->vif.link_conf[link_id], link_conf); if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
rcu_assign_pointer(sdata->link[link_id], link); struct ieee80211_sub_if_data *ap_bss;
struct ieee80211_bss_conf *ap_bss_conf;
ap_bss = container_of(sdata->bss,
struct ieee80211_sub_if_data, u.ap);
ap_bss_conf = sdata_dereference(ap_bss->vif.link_conf[link_id],
ap_bss);
memcpy(link_conf, ap_bss_conf, sizeof(*link_conf));
}
link->sdata = sdata; link->sdata = sdata;
link->link_id = link_id; link->link_id = link_id;
@@ -65,6 +73,9 @@ void ieee80211_link_init(struct ieee80211_sub_if_data *sdata,
ieee80211_link_debugfs_add(link); ieee80211_link_debugfs_add(link);
} }
rcu_assign_pointer(sdata->vif.link_conf[link_id], link_conf);
rcu_assign_pointer(sdata->link[link_id], link);
} }
void ieee80211_link_stop(struct ieee80211_link_data *link) void ieee80211_link_stop(struct ieee80211_link_data *link)