wifi: cfg80211: fix use-after-free in cmp_bss()

[ Upstream commit 26e84445f02ce6b2fe5f3e0e28ff7add77f35e08 ]

Following bss_free() quirk introduced in commit 776b3580178f
("cfg80211: track hidden SSID networks properly"), adjust
cfg80211_update_known_bss() to free the last beacon frame
elements only if they're not shared via the corresponding
'hidden_beacon_bss' pointer.

Reported-by: syzbot+30754ca335e6fb7e3092@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=30754ca335e6fb7e3092
Fixes: 3ab8227d3e7d ("cfg80211: refactor cfg80211_bss_update")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Link: https://patch.msgid.link/20250813135236.799384-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index d80ab1725f28ddb4d7be7990832a1565b3ef3192..f00ccc6d803be3c9e8b94d55db8e8df9beb9d642 100644 (file)
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1868,7 +1868,8 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
                         */
 
                        f = rcu_access_pointer(new->pub.beacon_ies);
-                       kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head);
+                       if (!new->pub.hidden_beacon_bss)
+                               kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head);
                        return false;
                }