iwlwifi-mld: Fix fw id leak in OOM case

[Ben Greear <greearb@candelatech.com>]

Hello Miriam,

I believe you will want to add something like this to your driver to clear the
fw_id_to_link_sta ID in case you hit the ENOMEM case.

I have no reason to believe I am actually hitting this error case, but I saw
this questionable code while looking for reasons for the use-after-free I am hitting.

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/sta.c b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
index 5fb2a46241e4..de9939ad1d58 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
@@ -535,13 +535,19 @@ iwl_mld_add_link_sta(struct iwl_mld *mld, struct ieee80211_link_sta *link_sta)
         ret = iwl_mld_allocate_link_sta_fw_id(mld, &fw_id, link_sta);
         if (ret)
                 return ret;

         if (link_sta == &link_sta->sta->deflink) {
                 mld_link_sta = &mld_sta->deflink;
         } else {
                 mld_link_sta = kzalloc(sizeof(*mld_link_sta), GFP_KERNEL);
-               if (!mld_link_sta)
+               if (!mld_link_sta) {
+                       IWL_ERR(mld, "mld-add-link-sta, OOM, clearing fw_id_to_link_sta[%d]\n",
+                               fw_id);
+                       RCU_INIT_POINTER(mld->fw_id_to_link_sta[fw_id], NULL);
                         return -ENOMEM;
+               }
         }

Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com