From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 31 Jul 2021 08:03:33 +0000 (+0200)
Subject: 4.4-stable patches
X-Git-Tag: v4.4.278~48
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4e9d7294773ed17b0bbcf6f676c46d69c737e567;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	cfg80211-fix-possible-memory-leak-in-function-cfg80211_bss_update.patch
---

diff --git a/queue-4.4/cfg80211-fix-possible-memory-leak-in-function-cfg80211_bss_update.patch b/queue-4.4/cfg80211-fix-possible-memory-leak-in-function-cfg80211_bss_update.patch
new file mode 100644
index 00000000000..9a7261ed312
--- /dev/null
+++ b/queue-4.4/cfg80211-fix-possible-memory-leak-in-function-cfg80211_bss_update.patch
@@ -0,0 +1,45 @@
+From f9a5c358c8d26fed0cc45f2afc64633d4ba21dff Mon Sep 17 00:00:00 2001
+From: Nguyen Dinh Phi <phind.uet@gmail.com>
+Date: Mon, 28 Jun 2021 21:23:34 +0800
+Subject: cfg80211: Fix possible memory leak in function cfg80211_bss_update
+
+From: Nguyen Dinh Phi <phind.uet@gmail.com>
+
+commit f9a5c358c8d26fed0cc45f2afc64633d4ba21dff upstream.
+
+When we exceed the limit of BSS entries, this function will free the
+new entry, however, at this time, it is the last door to access the
+inputed ies, so these ies will be unreferenced objects and cause memory
+leak.
+Therefore we should free its ies before deallocating the new entry, beside
+of dropping it from hidden_list.
+
+Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
+Link: https://lore.kernel.org/r/20210628132334.851095-1-phind.uet@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/wireless/scan.c |    6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -947,16 +947,14 @@ cfg80211_bss_update(struct cfg80211_regi
+ 			 * be grouped with this beacon for updates ...
+ 			 */
+ 			if (!cfg80211_combine_bsses(rdev, new)) {
+-				kfree(new);
++				bss_ref_put(rdev, new);
+ 				goto drop;
+ 			}
+ 		}
+ 
+ 		if (rdev->bss_entries >= bss_entries_limit &&
+ 		    !cfg80211_bss_expire_oldest(rdev)) {
+-			if (!list_empty(&new->hidden_list))
+-				list_del(&new->hidden_list);
+-			kfree(new);
++			bss_ref_put(rdev, new);
+ 			goto drop;
+ 		}
+ 
diff --git a/queue-4.4/series b/queue-4.4/series
index c833cf32dbb..0bfa94a90ff 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -17,3 +17,4 @@ can-ems_usb-fix-memory-leak.patch
 can-esd_usb2-fix-memory-leak.patch
 niu-fix-incorrect-error-return-missed-in-previous-revert.patch
 x86-asm-ensure-asm-proto.h-can-be-included-stand-alo.patch
+cfg80211-fix-possible-memory-leak-in-function-cfg80211_bss_update.patch