From: Benjamin Berg <benjamin.berg@intel.com>
Date: Thu, 30 Oct 2025 08:24:32 +0000 (+0100)
Subject: AP: Fix use after free in link reconfiguration
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2dc279c1ef89332bdfd3de2bec1ed0f5340097e7;p=thirdparty%2Fhostap.git

AP: Fix use after free in link reconfiguration

Print the station MAC address before freeing the data.

Fixes: e166a37632d4 ("AP MLD: Control interface events for ML Setup Link Reconfiguration)
CC: Mohan Kumar G <quic_mkumarg@quicinc.com>
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
---

diff --git a/src/ap/ieee802_11_eht.c b/src/ap/ieee802_11_eht.c
index c68900c16..feeb77ebe 100644
--- a/src/ap/ieee802_11_eht.c
+++ b/src/ap/ieee802_11_eht.c
@@ -1677,10 +1677,10 @@ void hostapd_link_reconf_resp_tx_status(struct hostapd_data *hapd,
 		}
 
 		/* Free as a link STA */
-		ap_free_sta(lhapd, lsta);
 		wpa_msg(hapd->msg_ctx, MSG_INFO,
 			WPA_EVENT_LINK_STA_REMOVED "sta=" MACSTR " link_id=%u",
 			MAC2STR(lsta->addr), link_id);
+		ap_free_sta(lhapd, lsta);
 
 		for_each_mld_link(other_hapd, lhapd) {
 			struct mld_link_info *link;