linux/net/wireless
Dmitry Antipov 26e84445f0 wifi: cfg80211: fix use-after-free in cmp_bss()
Following bss_free() quirk introduced in commit 776b358017
("cfg80211: track hidden SSID networks properly"), adjust
cfg80211_update_known_bss() to free the last beacon frame
elements only if they're not shared via the corresponding
'hidden_beacon_bss' pointer.

Reported-by: syzbot+30754ca335e6fb7e3092@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=30754ca335e6fb7e3092
Fixes: 3ab8227d3e ("cfg80211: refactor cfg80211_bss_update")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Link: https://patch.msgid.link/20250813135236.799384-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-08-26 13:45:09 +02:00
..
certs wifi: cfg80211: fix certs build to not depend on file order 2023-12-14 09:11:51 +01:00
tests wireless-next patches for v6.14 2024-12-19 18:54:07 -08:00
.gitignore .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
ap.c wifi: cfg80211: remove wdev mutex 2023-09-11 11:27:23 +02:00
chan.c wifi: cfg80211: expose cfg80211_chandef_get_width() 2025-03-12 09:50:24 +01:00
core.c wifi: cfg80211: hide scan internals 2025-07-09 11:52:35 +02:00
core.h wifi: cfg80211: hide scan internals 2025-07-09 11:52:35 +02:00
debugfs.c wifi: cfg80211: add locked debugfs wrappers 2023-11-27 11:24:58 +01:00
debugfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ethtool.c wifi: cfg80211: use strscpy to replace strlcpy 2022-07-15 11:43:12 +02:00
ibss.c wifi: cfg80211: move DFS related members to links[] in wireless_dev 2024-09-06 13:01:05 +02:00
Kconfig wifi: cfg80211: stop exporting wext symbols 2024-10-08 21:53:31 +02:00
Makefile wifi: wext/libipw: move spy implementation to libipw 2024-10-08 21:53:18 +02:00
mesh.c wifi: cfg80211: move DFS related members to links[] in wireless_dev 2024-09-06 13:01:05 +02:00
mlme.c wifi: cfg80211: reject HTC bit for management frames 2025-07-21 19:35:45 +02:00
nl80211.c wifi: nl80211: Set num_sub_specs before looping through sub_specs 2025-07-22 10:38:39 +02:00
nl80211.h wifi: cfg80211: Add support for dynamic addition/removal of links 2025-01-13 15:34:08 +01:00
ocb.c wifi: cfg80211: remove wdev mutex 2023-09-11 11:27:23 +02:00
of.c
pmsr.c wifi: cfg80211: define and use wiphy guard 2024-12-04 16:10:52 +01:00
radiotap.c Merge net-next/main to resolve conflicts 2024-10-09 08:59:22 +02:00
rdev-ops.h wifi: cfg80211: hide scan internals 2025-07-09 11:52:35 +02:00
reg.c wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() 2025-07-18 14:24:28 +02:00
reg.h wifi: cfg80211: add return docs for regulatory functions 2024-04-19 10:29:08 +02:00
scan.c wifi: cfg80211: fix use-after-free in cmp_bss() 2025-08-26 13:45:09 +02:00
sme.c wifi: cfg80211/mac80211: remove wrong scan request n_channels 2025-07-18 14:07:35 +02:00
sysfs.c wifi: cfg80211: fully move wiphy work to unbound workqueue 2024-05-29 15:23:33 +02:00
sysfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
trace.c
trace.h wifi: cfg80211/mac80211: report link ID for unexpected frames 2025-07-21 19:40:59 +02:00
util.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2025-07-11 11:42:38 -07:00
wext-compat.c wifi: cfg80211/mac80211: Add support to get radio index 2025-06-24 15:19:27 +02:00
wext-compat.h Revert "wifi: cfg80211: unexport wireless_nlevent_flush()" 2024-10-09 08:53:01 +02:00
wext-core.c net: s/dev_get_flags/netif_get_flags/ 2025-07-18 17:27:47 -07:00
wext-priv.c
wext-proc.c proc: introduce proc_create_net{,_data} 2018-05-16 07:24:30 +02:00
wext-sme.c wifi: cfg80211: define and use wiphy guard 2024-12-04 16:10:52 +01:00