diff mbox series

[01/10] MLD: Ensure link BSSIDs remain on stack for ignore

Message ID 20240614081351.2088185-2-benjamin@sipsolutions.net
State New
Headers show
Series Some ASAN/UBSAN related fixes | expand

Commit Message

Benjamin Berg June 14, 2024, 8:13 a.m. UTC 
From: Benjamin Berg <benjamin.berg@intel.com>

When ignoring a link BSSID the multi-link information was parsed out
into a struct ml_sta_link_info on the stack. However, this stack
variable went out of scope before it was used by passing the link_bssids
pointer array to another function.

Fixes: 5af986c75af4 ("MLD: Also mark links as failed after association failure")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
---
 wpa_supplicant/events.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index 447fc8fd80..656bab5c44 100644
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -5619,6 +5619,7 @@  static void wpas_event_assoc_reject(struct wpa_supplicant *wpa_s,
 {
 	const u8 *bssid = data->assoc_reject.bssid;
 	struct ieee802_11_elems elems;
+	struct ml_sta_link_info ml_info[MAX_NUM_MLD_LINKS];
 	const u8 *link_bssids[MAX_NUM_MLD_LINKS];
 #ifdef CONFIG_MBO
 	struct wpa_bss *reject_bss;
@@ -5751,7 +5752,6 @@  static void wpas_event_assoc_reject(struct wpa_supplicant *wpa_s,
 	if (ieee802_11_parse_elems(data->assoc_reject.resp_ies,
 				   data->assoc_reject.resp_ies_len,
 				   &elems, 1) != ParseFailed) {
-		struct ml_sta_link_info ml_info[MAX_NUM_MLD_LINKS];
 		unsigned int n_links, i, idx;
 
 		idx = 0;