diff options
| author | Dmitry Antipov <dmantipov@yandex.ru> | 2025-08-13 16:52:36 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-09-09 18:50:18 +0200 |
| commit | ff040562c10a540b8d851f7f4145fa112977f853 (patch) | |
| tree | 6b411d6fc98e0f8c6261fdf5949e33d4b645274b /net/wireless/scan.c | |
| parent | 0f70fab5598de18773c93e62c9c4ff349c9141c5 (diff) | |
| download | linux-ff040562c10a540b8d851f7f4145fa112977f853.tar.gz linux-ff040562c10a540b8d851f7f4145fa112977f853.tar.bz2 linux-ff040562c10a540b8d851f7f4145fa112977f853.zip | |
wifi: cfg80211: fix use-after-free in cmp_bss()
[ Upstream commit 26e84445f02ce6b2fe5f3e0e28ff7add77f35e08 ]
Following bss_free() quirk introduced in commit 776b3580178f
("cfg80211: track hidden SSID networks properly"), adjust
cfg80211_update_known_bss() to free the last beacon frame
elements only if they're not shared via the corresponding
'hidden_beacon_bss' pointer.
Reported-by: syzbot+30754ca335e6fb7e3092@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=30754ca335e6fb7e3092
Fixes: 3ab8227d3e7d ("cfg80211: refactor cfg80211_bss_update")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Link: https://patch.msgid.link/20250813135236.799384-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/wireless/scan.c')
| -rw-r--r-- | net/wireless/scan.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/wireless/scan.c b/net/wireless/scan.c index d977d7a7675e..e2b4149e5ff4 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -1768,7 +1768,8 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev, */ f = rcu_access_pointer(new->pub.beacon_ies); - kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head); + if (!new->pub.hidden_beacon_bss) + kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head); return false; } |