From nobody Sat Sep 26 13:09:09 2026 Received: from va-2-28.ptr.blmpb.com (va-2-28.ptr.blmpb.com [209.127.231.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8FA032C21D8 for ; Tue, 1 Sep 2026 08:05:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.127.231.28 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788249957; cv=none; b=sudNqOKnJ/ImBQkw98gYGbXEZq6fSVDGKqZ16J/N9BJnarIOO5grUf7fqLDgKaYoSR4VsvHnvXYFw4D03ykL0t+3DD6LKZcy9MnCLpDbHBfKggOYDKCGQGLkHyN6vA6ucTLkFBcsLKFiOx2gMDd2wqwBPQbcDXzvf+JO7E0tDZ0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788249957; c=relaxed/simple; bh=/fXyNC1SCrVVh1dlZ7cd+p57PMSaOXahAXDGkXDuVMo=; h=Content-Type:To:From:Date:Mime-Version:Cc:Subject:Message-Id; b=qKl7GrbOCWGMpnLK5bZwtA/WD5EvbuW6WrOtJWY7degixbupdp8f8ohw/RJLlMgN3Efbp6NkJfuxxr6F7+j1fwc3te5/B1znB45RAxyTRXeL6OwFfHUYfExmG91vFYlBB4jg6eyMqMwDPfD79tK9lwKxzbOw8EGfatPbavP7C1w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=moonshot.ai; spf=pass smtp.mailfrom=moonshot.ai; dkim=pass (2048-bit key) header.d=moonshot.ai header.i=@moonshot.ai header.b=i/NvTp+C; arc=none smtp.client-ip=209.127.231.28 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=moonshot.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=moonshot.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=moonshot.ai header.i=@moonshot.ai header.b="i/NvTp+C" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=feishu2510091218; d=moonshot.ai; t=1788249945; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=olD/KwTfA6Mw6pBOtKDza7C0xrnqoRE53Nj2OT+WgiA=; b=i/NvTp+C48190yZkH53H/TWbop5Po3JxSUmEmrrTnO+xxgm4EWtQR6HgF60HkK9BlZik+3 rSmQ+nKvNBE5fk/5IAnLwLL+g2Yxk/M0cgdJqXDNdz4V3eCyuCKIznf8n9mhUAzxP44XSV vzcSR0S4qSYI/7cY7dJlw0CvfD9aaaIs7mTR/k/Ox+ICWNWvNEiotlVpcLxs3TOYjVAaDl THDP6xn8iuSPJyHRk6P5lmD94YqPD4BDmbO53yXZIexfckRb8uUb+btBM8e0N7b7LdOD3s +JubZrUZFp6xkBXK39F9xoOOxmOjNt7PMZvaf0X7I4Dhfp9LqDqoG6P1oMB+1w== Received: from dev.msh-dev.svc.cluster.local ([117.157.206.135]) by smtp.feishu.cn with ESMTPS; Tue, 01 Sep 2026 16:05:42 +0800 To: "Johannes Berg" X-Lms-Return-Path: Content-Transfer-Encoding: quoted-printable From: "Yilin Zhang" Date: Tue, 1 Sep 2026 16:04:27 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Original-From: Yilin Zhang Cc: "Yilin Zhang" , , , "Sergey Matyukevich" , "Dmitry Antipov" , "Kimi Security Team" Subject: [PATCH] cfg80211: fix double-free of shared hidden-group beacon IEs Message-Id: <20260901080427.1983015-1-yilinzhang@moonshot.ai> X-Mailer: git-send-email 2.34.1 Content-Type: text/plain; charset="utf-8" cfg80211_update_known_bss() adopts new->pub.beacon_ies without checking whether new is a hidden group member. cfg80211_update_assoc_bss_entry() can pass such a member as new on a CSA channel switch, so the same IEs get two owners and are freed twice. Same issue as commit 26e84445f02c ("wifi: cfg80211: fix use-after-free in cmp_bss()"), which fixed only the drop path. Reported-by: Kimi Security Team Fixes: 0afd425b1b64 ("cfg80211: fix duplicated scan entries after channel s= witch") Signed-off-by: Yilin Zhang --- net/wireless/scan.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 071083c..1fbbcda 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -1937,6 +1937,9 @@ cfg80211_update_known_bss(struct cfg80211_registered_= device *rdev, return false; } =20 + if (new->pub.hidden_beacon_bss) + return true; + old =3D rcu_access_pointer(known->pub.beacon_ies); =20 rcu_assign_pointer(known->pub.beacon_ies, new->pub.beacon_ies); --=20 2.34.1