[PATCH] nl80211: Fix use-after-free during wiphy event handling

[Jouni Malinen]

On Fri, Apr 18, 2025 at 01:55:00PM +0200, Gwen Weinholt wrote:
> When processing a NL80211_CMD_RADAR_DETECT event, the current driver
> interface instance may be deinitialized during the event handler.
> The event loop still holds a pointer to the old driver interface,
> but using it after deinit can cause a crash.
> 
> A previous attempt to fix this relied on checking whether the
> interface pointer still appeared in the list of interfaces.
> However, that approach is incomplete: if malloc() returns the same
> pointer for a newly added interface (as observed occasionally on
> glibc 2.31), the check incorrectly assumes the original instance
> still exists.
> 
> To fix this reliably, this commit introduces a unique instance ID
> in the wpa_driver_nl80211_data struct and uses that ID to check
> whether the original driver instance is still present in the list.

Thanks, applied.

-- 
Jouni Malinen                                            PGP id EFC895FA