• Matthias Schiffer's avatar
    mac80211: fix crash on mesh local link ID generation with VIFs · 520c75dc
    Matthias Schiffer authored
    llid_in_use needs to be limited to stations of the same VIF, otherwise it
    will cause a NULL deref as the sta_info of non-mesh-VIFs don't have
    sta->mesh set.
    
    Steps to reproduce:
    
       modprobe mac80211_hwsim channels=2
       iw phy phy0 interface add ibss0 type ibss
       iw phy phy0 interface add mesh0 type mp
       iw phy phy1 interface add ibss1 type ibss
       iw phy phy1 interface add mesh1 type mp
       ip link set ibss0 up
       ip link set mesh0 up
       ip link set ibss1 up
       ip link set mesh1 up
       iw dev ibss0 ibss join foo 2412
       iw dev ibss1 ibss join foo 2412
       # Ensure that ibss0 and ibss1 are actually associated; I often need to
       # leave and join the cell on ibss1 a second time.
       iw dev mesh0 mesh join bar
       iw dev mesh1 mesh join bar # crash
    Signed-off-by: default avatarMatthias Schiffer <mschiffer@universe-factory.net>
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    520c75dc
mesh_plink.c 30.8 KB