From: Ben Greear If memory cannot be allocated, clear the fw_id_to_link_sta so there is not a dangling pointer that may later be accessed and cause use-after-free. Signed-off-by: Ben Greear --- drivers/net/wireless/intel/iwlwifi/mld/sta.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mld/sta.c b/drivers/net/wireless/intel/iwlwifi/mld/sta.c index 6b7a89e050e6..c478cee570a2 100644 --- a/drivers/net/wireless/intel/iwlwifi/mld/sta.c +++ b/drivers/net/wireless/intel/iwlwifi/mld/sta.c @@ -540,8 +540,10 @@ iwl_mld_add_link_sta(struct iwl_mld *mld, struct ieee80211_link_sta *link_sta) mld_link_sta = &mld_sta->deflink; } else { mld_link_sta = kzalloc_obj(*mld_link_sta); - if (!mld_link_sta) + if (!mld_link_sta) { + RCU_INIT_POINTER(mld->fw_id_to_link_sta[fw_id], NULL); return -ENOMEM; + } } mld_link_sta->fw_id = fw_id; -- 2.42.0