Re: iwlwifi-mld: Fix fw id leak in OOM case

[Ben Greear <greearb@candelatech.com>]

On 3/2/26 23:28, Korenblit, Miriam Rachel wrote:
> 
> 
>> -----Original Message-----
>> From: Ben Greear <greearb@candelatech.com>
>> Sent: Tuesday, March 3, 2026 1:07 AM
>> To: linux-wireless <linux-wireless@vger.kernel.org>; Korenblit, Miriam Rachel
>> <miriam.rachel.korenblit@intel.com>
>> Subject: iwlwifi-mld: Fix fw id leak in OOM case
>>
>> Hello Miriam,
>>
>> I believe you will want to add something like this to your driver to clear the
>> fw_id_to_link_sta ID in case you hit the ENOMEM case.
>>
>> I have no reason to believe I am actually hitting this error case, but I saw this
>> questionable code while looking for reasons for the use-after-free I am hitting.
>>
>> diff --git a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
>> b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
>> index 5fb2a46241e4..de9939ad1d58 100644
>> --- a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
>> +++ b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
>> @@ -535,13 +535,19 @@ iwl_mld_add_link_sta(struct iwl_mld *mld, struct
>> ieee80211_link_sta *link_sta)
>>           ret = iwl_mld_allocate_link_sta_fw_id(mld, &fw_id, link_sta);
>>           if (ret)
>>                   return ret;
>>
>>           if (link_sta == &link_sta->sta->deflink) {
>>                   mld_link_sta = &mld_sta->deflink;
>>           } else {
>>                   mld_link_sta = kzalloc(sizeof(*mld_link_sta), GFP_KERNEL);
>> -               if (!mld_link_sta)
>> +               if (!mld_link_sta) {
>> +                       IWL_ERR(mld, "mld-add-link-sta, OOM, clearing
>> fw_id_to_link_sta[%d]\n",
>> +                               fw_id);
>> +                       RCU_INIT_POINTER(mld->fw_id_to_link_sta[fw_id],
>> + NULL);
>>                           return -ENOMEM;
>> +               }
>>           }
>>
>> Thanks,
>> Ben
>>
>> --
>> Ben Greear <greearb@candelatech.com>
>> Candela Technologies Inc  http://www.candelatech.com
> 
> Please send a patch

Are you fine with having IWL_ERR in the patch like I have above?

Thanks,
Ben

> 

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com