mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-14 00:07:09 +04:00
Felix Fietkau
178994ca82
A later link of an AP MLD takes the driver instance of the first link (hapd->drv_priv = h_hapd->drv_priv) in hostapd_driver_init() and joins the MLD only after hostapd_drv_link_add() succeeds. When that call, or the check for driver MLO support, fails, the link returns -1 with the borrowed pointer still set. The caller's cleanup, hostapd_deinit_driver(), then treats the instance as its own: hostapd_cleanup_driver() removes the link with this BSS's link ID from the shared instance, which is the link of another BSS when the link IDs collide, or deinits the instance when it looks unshared. The first link keeps a pointer to a torn down or freed instance, and the next link that is set up calls get_capa() on it and crashes hostapd. Seen with an AP MLD whose links span two wiphys: the link on the second wiphy was assigned link ID 0, hostapd_drv_link_add() refused it, and the cleanup removed link 0 of the first wiphy. A link that never joined the MLD now drops the borrowed instance before it returns, so the cleanup leaves the first link alone. Signed-off-by: Felix Fietkau <nbd@nbd.name>