From: Zhao Li <enderaoelyther@gmail.com>
Date: Wed, 10 Jun 2026 11:22:09 +0000 (+0800)
Subject: wifi: nl80211: free RNR data on MBSSID mismatch
X-Git-Tag: v7.2-rc4~17^2~16^2~21
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=07a95ec2b54774201fdf4ef7ffb0ca2ab19ed29c;p=thirdparty%2Fkernel%2Flinux.git

wifi: nl80211: free RNR data on MBSSID mismatch

nl80211_parse_beacon() rejects EMA RNR data when there are fewer RNR
entries than MBSSID entries.

The rejected RNR allocation has not been attached to the beacon data yet,
so free it before returning the error.

Fixes: dbbb27e183b1 ("cfg80211: support RNR for EMA AP")
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260610112208.1308-2-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 53b4b3f76697..056388c04599 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -6803,8 +6803,10 @@ static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
 			if (IS_ERR(rnr))
 				return PTR_ERR(rnr);
 
-			if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
+			if (rnr && rnr->cnt < bcn->mbssid_ies->cnt) {
+				kfree(rnr);
 				return -EINVAL;
+			}
 
 			bcn->rnr_ies = rnr;
 		}