[PATCH 0/3] wifi: iwlwifi: fix RCU lifetime on setup failures

[Zhao Li]

Two key-add error paths remove packet-number state from RCU-protected
pointers and then free it immediately. Concurrent RX readers can still
hold the removed objects.

The MLD link-add error path has a related problem. It can free a link
without first removing a restart-time published pointer, or free it
immediately after unpublishing it on a later firmware failure.

Use the RCU-delayed freeing already used by the corresponding normal
removal paths, and make the link mapping cleanup common to every failed
link add. Keep the MVM and MLD fixes separate because their origins,
objects and maintained-line exposure differ.

Zhao Li (3):
  wifi: iwlwifi: mvm: defer freeing PTK PN state on key failure
  wifi: iwlwifi: mld: defer freeing PTK PN state on key failure
  wifi: iwlwifi: mld: unpublish links before freeing on add failure

 drivers/net/wireless/intel/iwlwifi/mld/link.c     | 4 ++--
 drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

base-commit: 50d3d79dc0743b616afb00d01a626c76758721f7
-- 
2.55.0