ieee80211_debugfs_key_update_default() stores dentry pointers for the default unicast and multicast key symlinks. Recreating the netdev debugfs tree removes that parent directory and clears the parent and stations pointers, but not those child dentries. A later default-key update then passes the freed dentries to debugfs_remove(). Clear the stale pointers when the netdev debugfs tree is removed, and recreate the default-key symlinks after the directory is rebuilt. Fixes: c942398f95ef ("wifi: mac80211: handle debugfs when switching to/from MLO") Cc: stable@vger.kernel.org Reported-by: Vega Signed-off-by: Zhiling Zou --- net/mac80211/debugfs_netdev.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c index f3c6a41e49119..a00b0776fdb1d 100644 --- a/net/mac80211/debugfs_netdev.c +++ b/net/mac80211/debugfs_netdev.c @@ -20,6 +20,7 @@ #include "ieee80211_i.h" #include "rate.h" #include "debugfs.h" +#include "debugfs_key.h" #include "debugfs_netdev.h" #include "driver-ops.h" @@ -1020,6 +1021,8 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata) debugfs_remove_recursive(sdata->vif.debugfs_dir); sdata->vif.debugfs_dir = NULL; sdata->debugfs.subdir_stations = NULL; + sdata->debugfs.default_unicast_key = NULL; + sdata->debugfs.default_multicast_key = NULL; } void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata) @@ -1032,6 +1035,7 @@ void ieee80211_debugfs_recreate_netdev(struct ieee80211_sub_if_data *sdata, { ieee80211_debugfs_remove_netdev(sdata); ieee80211_debugfs_add_netdev(sdata, mld_vif); + ieee80211_debugfs_key_update_default(sdata); if (sdata->flags & IEEE80211_SDATA_IN_DRIVER) { drv_vif_add_debugfs(sdata->local, sdata); -- 2.43.0