mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 14:51:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

staging: rtl8723bs: fix potential race in expire_timeout_chk

Browse Source 
The expire_timeout_chk function currently do lock and unlock inside the
loop before calling rtw_free_stainfo().

This can be risky as the list might be changed
when the lock is briefly released.

To fix this, move expired sta_info entries into a local free_list while
holding the lock, and then perform the actual freeing after the lock is
released.

Signed-off-by: Minu Jin <s9430939@naver.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/20260131171153.3729458-1-s9430939@naver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Minu Jin
2026-02-01 02:11:53 +09:00
committed by Greg Kroah-Hartman
parent 8ae0398e70
commit 02df7c635b
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/staging/rtl8723bs/core/rtw_ap.c
View File

@@ -178,6 +178,8 @@ void expire_timeout_chk(struct adapter *padapter)
struct sta_priv *pstapriv = &padapter->stapriv;
u8 chk_alive_num = 0;
char chk_alive_list[NUM_STA];
struct sta_info *psta_tmp;
LIST_HEAD(free_list);
int i;
spin_lock_bh(&pstapriv->auth_list_lock);
@@ -190,19 +192,19 @@ void expire_timeout_chk(struct adapter *padapter)
if (psta->expire_to > 0) {
psta->expire_to--;
if (psta->expire_to == 0) {
list_del_init(&psta->auth_list);
list_move(&psta->auth_list, &free_list);
pstapriv->auth_list_cnt--;
spin_unlock_bh(&pstapriv->auth_list_lock);
rtw_free_stainfo(padapter, psta);
spin_lock_bh(&pstapriv->auth_list_lock);
}
}
}
spin_unlock_bh(&pstapriv->auth_list_lock);
list_for_each_entry_safe(psta, psta_tmp, &free_list, auth_list) {
list_del_init(&psta->auth_list);
rtw_free_stainfo(padapter, psta);
}
psta = NULL;
spin_lock_bh(&pstapriv->asoc_list_lock);