Commit 26e84445 authored by Dmitry Antipov's avatar Dmitry Antipov Committed by Johannes Berg
Browse files

wifi: cfg80211: fix use-after-free in cmp_bss() 



Following bss_free() quirk introduced in commit 776b3580
("cfg80211: track hidden SSID networks properly"), adjust
cfg80211_update_known_bss() to free the last beacon frame
elements only if they're not shared via the corresponding
'hidden_beacon_bss' pointer.

Reported-by: default avatar <syzbot+30754ca335e6fb7e3092@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=30754ca335e6fb7e3092


Fixes: 3ab8227d ("cfg80211: refactor cfg80211_bss_update")
Signed-off-by: default avatarDmitry Antipov <dmantipov@yandex.ru>
Link: https://patch.msgid.link/20250813135236.799384-1-dmantipov@yandex.ru


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent f64768be

net/wireless/scan.c

+2 −1
Original line number Diff line number Diff line
@@ -1916,6 +1916,7 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev, 
			 */



			f = rcu_access_pointer(new->pub.beacon_ies);

			if (!new->pub.hidden_beacon_bss)

				kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head);

			return false;

		}