wifi: cfg80211: clear wdev->cqm_config pointer on free

commit d5fee261dfd9e17b08b1df8471ac5d5736070917 upstream. When we free wdev->cqm_config when unregistering, we also need to clear out the pointer since the same wdev/netdev may get re-registered in another network namespace, then destroyed later, running this code again, which results in a double-free. Reported-by: [email protected] Fixes: 37c20b2 ("wifi: cfg80211: fix cqm_config access race") Cc: [email protected] Link: https://patch.msgid.link/20241022161742.7c34b2037726.I121b9cdb7eb180802eafc90b493522950d57ee18@changeid Signed-off-by: Johannes Berg <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
Avenger-285714 · Nov 11, 2024 · b5126b8 · b5126b8
1 parent e3c1dcd
commit b5126b8
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/net/wireless/core.c b/net/wireless/core.c
@@ -1231,6 +1231,7 @@ static void _cfg80211_unregister_wdev(struct wireless_dev *wdev,
 	/* deleted from the list, so can't be found from nl80211 any more */
 	cqm_config = rcu_access_pointer(wdev->cqm_config);
 	kfree_rcu(cqm_config, rcu_head);
+	RCU_INIT_POINTER(wdev->cqm_config, NULL);
 
 	/*
 	 * Ensure that all events have been processed and