Commit 539b44e7 authored by Dan Carpenter's avatar Dan Carpenter Committed by Kalle Valo
Browse files

ath10k: fixup extended per sta tx statistics 



I had a couple concerns with this code.  First, we definitely need to
set the error code if the kzalloc() fails.  Secondly, I was worried that
if we didn't set "arsta->tx_stats" to NULL after freeing it, then it
looks to me like it might lead to a use after free.  I can't test that,
but it's harmless to set it to NULL so I did.

Fixes: a904417f ("ath10k: add extended per sta tx statistics support")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 13104929

drivers/net/wireless/ath/ath10k/mac.c

+6 −2
Original line number Diff line number Diff line
@@ -6296,9 +6296,11 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, 
		if (ath10k_debug_is_extd_tx_stats_enabled(ar)) {

			arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats),

						  GFP_KERNEL);

			if (!arsta->tx_stats)

			if (!arsta->tx_stats) {

				ret = -ENOMEM;

				goto exit;

			}

		}



		num_tdls_stations = ath10k_mac_tdls_vif_stations_count(hw, vif);

		num_tdls_vifs = ath10k_mac_tdls_vifs_count(hw);
@@ -6385,8 +6387,10 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, 
			   "mac vdev %d peer delete %pM sta %pK (sta gone)\n",

			   arvif->vdev_id, sta->addr, sta);



		if (ath10k_debug_is_extd_tx_stats_enabled(ar))

		if (ath10k_debug_is_extd_tx_stats_enabled(ar)) {

			kfree(arsta->tx_stats);

			arsta->tx_stats = NULL;

		}



		if (sta->tdls) {

			ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id,