cfg80211: fix double-free after changing network namespace
authorStefan Bühler <source@stbuehler.de>
Tue, 26 Nov 2019 10:05:44 +0000 (11:05 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 12 Jan 2020 11:21:28 +0000 (12:21 +0100)
commit2d68f35b7bcf77a4fbb34b683e291d0d01cba50c
treed1deb2db7fd3bacce4f1a2eae935dd0aaaf6db3e
parenta6fdd8858cd2050b4501033f05a5278ba1b24e05
cfg80211: fix double-free after changing network namespace

[ Upstream commit 56cb31e185adb61f930743a9b70e700a43625386 ]

If wdev->wext.keys was initialized it didn't get reset to NULL on
unregister (and it doesn't get set in cfg80211_init_wdev either), but
wdev is reused if unregister was triggered through
cfg80211_switch_netns.

The next unregister (for whatever reason) will try to free
wdev->wext.keys again.

Signed-off-by: Stefan Bühler <source@stbuehler.de>
Link: https://lore.kernel.org/r/20191126100543.782023-1-stefan.buehler@tik.uni-stuttgart.de
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/wireless/core.c