Commit 56cb31e1 authored Nov 26, 2019 by Stefan Bühler Committed by Johannes Berg Dec 13, 2019

cfg80211: fix double-free after changing network namespace



If wdev->wext.keys was initialized it didn't get reset to NULL on
unregister (and it doesn't get set in cfg80211_init_wdev either), but
wdev is reused if unregister was triggered through
cfg80211_switch_netns.

The next unregister (for whatever reason) will try to free
wdev->wext.keys again.

Signed-off-by: Stefan Bühler <source@stbuehler.de>
Link: https://lore.kernel.org/r/20191126100543.782023-1-stefan.buehler@tik.uni-stuttgart.de


Signed-off-by: Johannes Berg <johannes.berg@intel.com>

parent 753ffad3

net/wireless/core.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -1102,6 +1102,7 @@ static void __cfg80211_unregister_wdev(struct wireless_dev *wdev, bool sync)

		#ifdef CONFIG_CFG80211_WEXT
		kzfree(wdev->wext.keys);
		wdev->wext.keys = NULL;
		#endif
		/* only initialized if we have a netdev */
		if (wdev->netdev)

Admin message