| developer | bbb2f36 | 2022-04-01 09:46:58 +0800 | [diff] [blame] | 1 | From 95953b3adaadf15ad5ae637d4e0e433c3bfb0835 Mon Sep 17 00:00:00 2001 |
| 2 | From: Bo Jiao <Bo.Jiao@mediatek.com> |
| 3 | Date: Thu, 31 Mar 2022 11:23:02 +0800 |
| 4 | Subject: [PATCH] mt76: mt7915: add list_del_init(&msta->wcid.list) |
| 5 | |
| 6 | msta->wcid may use after free when do mt76_tx_status_check |
| 7 | |
| 8 | Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com> |
| 9 | --- |
| 10 | mt7915/main.c | 5 +++++ |
| 11 | 1 file changed, 5 insertions(+) |
| 12 | |
| 13 | diff --git a/mt7915/main.c b/mt7915/main.c |
| 14 | index 9de5f152..fc271e3c 100644 |
| 15 | --- a/mt7915/main.c |
| 16 | +++ b/mt7915/main.c |
| 17 | @@ -729,6 +729,11 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif, |
| 18 | if (!list_empty(&msta->rc_list)) |
| 19 | list_del_init(&msta->rc_list); |
| 20 | spin_unlock_bh(&dev->sta_poll_lock); |
| 21 | + |
| 22 | + spin_lock_bh(&mdev->status_lock); |
| 23 | + if (!list_empty(&msta->wcid.list)) |
| 24 | + list_del_init(&msta->wcid.list); |
| 25 | + spin_unlock_bh(&mdev->status_lock); |
| 26 | } |
| 27 | |
| 28 | static void mt7915_tx(struct ieee80211_hw *hw, |
| 29 | -- |
| 30 | 2.18.0 |
| 31 | |