Dmitry Antipov ff040562c1 wifi: cfg80211: fix use-after-free in cmp_bss() ...

[ Upstream commit 26e84445f0 ]

Following bss_free() quirk introduced in commit 776b358017
("cfg80211: track hidden SSID networks properly"), adjust
cfg80211_update_known_bss() to free the last beacon frame
elements only if they're not shared via the corresponding
'hidden_beacon_bss' pointer.

Reported-by: syzbot+30754ca335e6fb7e3092@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=30754ca335e6fb7e3092
Fixes: 3ab8227d3e ("cfg80211: refactor cfg80211_bss_update")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Link: https://patch.msgid.link/20250813135236.799384-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-09-09 18:50:18 +02:00

..

certs

wifi: cfg80211: fix certs build to not depend on file order

2024-01-05 15:13:33 +01:00

.gitignore

…

ap.c

…

chan.c

…

core.c

wifi: cfg80211: lock wiphy mutex for rfkill poll

2024-01-25 14:52:27 -08:00

core.h

Revert "wifi: cfg80211: check wiphy mutex is held for wdev mutex"

2024-10-17 15:10:41 +02:00

debugfs.c

…

debugfs.h

…

ethtool.c

…

ibss.c

…

Kconfig

…

lib80211_crypt_ccmp.c

…

lib80211_crypt_tkip.c

…

lib80211_crypt_wep.c

…

lib80211.c

…

Makefile

…

mesh.c

…

mlme.c

wifi: cfg80211: reject HTC bit for management frames

2025-08-28 16:24:20 +02:00

nl80211.c

wifi: nl80211: reject cooked mode if it is set along with other flags

2025-03-13 12:51:03 +01:00

nl80211.h

…

ocb.c

…

of.c

…

pmsr.c

wifi: cfg80211: pmsr: use correct nla_get_uX functions

2024-07-05 09:14:05 +02:00

radiotap.c

…

rdev-ops.h

…

reg.c

wifi: cfg80211: regulatory: improve invalid hints checking

2025-03-13 12:51:02 +01:00

reg.h

…

scan.c

wifi: cfg80211: fix use-after-free in cmp_bss()

2025-09-09 18:50:18 +02:00

sme.c

wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors

2024-10-17 15:10:45 +02:00

sysfs.c

…

sysfs.h

…

trace.c

…

trace.h

wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class

2024-06-16 13:39:13 +02:00

util.c

wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()

2024-08-19 05:44:57 +02:00

wext-compat.c

…

wext-compat.h

…

wext-core.c

wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()

2024-03-01 13:21:55 +01:00

wext-priv.c

…

wext-proc.c

…

wext-sme.c

…

wext-spy.c

…