[BUG] net/mac80211: use-after-free in ieee80211_remove_link_keys()

[co]

We found a bug reachable in:

    path    net/mac80211
    crash   use-after-free in ieee80211_remove_link_keys()
    commit  53d3c6ddbb97 ("Linux 6.12.62")

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
    If you patch the bug based on our artifacts, a tag would be
    appreciated:

Reported-by: co+36935f8953d6874a@xxxxxxx

    Everything in this mail is validated by the reproducer below.

    We also hold an LLM-generated root-cause analysis and a candidate
    patch. The patch passes an A/B test: the same reproducer panics the
    unpatched kernel and runs clean on the patched one. Neither has had
    human review, so both still require validation before you send or
    apply them. Available on:

        patch.diff  https://bugs.sh/b/36935f8953d6874a/patch.diff
        report.md   https://bugs.sh/b/36935f8953d6874a/report.md

    This is an open science project. The code and the full set of PoCs
    are not public at this moment, as we intend to disclose our findings
    in an ethical way.

    Happy to test patches. Complaints and suggestions about our work
    are welcome at:

        cedalion@xxxxxxx

== Environment =========================================================
    Reproduced on  53d3c6ddbb97 ("Linux 6.12.62")
    VM setup       https://bugs.sh/b/36935f8953d6874a/run.sh
    config         https://bugs.sh/b/36935f8953d6874a/config.gz
    poc            https://bugs.sh/b/36935f8953d6874a/repro.c

== Sanitizer Report ====================================================
BUG: KASAN: slab-use-after-free in ieee80211_remove_link_keys (net/mac80211/key.c:1114)
Read of size 8 at addr ffff888028c3c818 by task exploit/5192
CPU: 1 UID: 65534 PID: 5192 Comm: exploit Not tainted 6.12.62 #3
Call Trace:
dump_stack_lvl (lib/dump_stack.c:123)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:481)
kasan_report (mm/kasan/report.c:596)
ieee80211_remove_link_keys (net/mac80211/key.c:1114)
ieee80211_vif_update_links (net/mac80211/link.c:192 net/mac80211/link.c:351)
ieee80211_vif_set_links (net/mac80211/link.c:408)
cfg80211_remove_link (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:207 net/wireless/trace.h:425 net/wireless/rdev-ops.h:1460 net/wireless/util.c:2894)
nl80211_remove_link (net/wireless/nl80211.c:16312)
genl_family_rcv_msg_doit (net/netlink/genetlink.c:1117)
genl_rcv_msg (net/netlink/genetlink.c:1195 net/netlink/genetlink.c:1210)
netlink_rcv_skb (net/netlink/af_netlink.c:2546)
genl_rcv (net/netlink/genetlink.c:1220)
netlink_unicast (net/netlink/af_netlink.c:1314 net/netlink/af_netlink.c:1339)
netlink_sendmsg (net/netlink/af_netlink.c:1889)
__sys_sendto (net/socket.c:729 (discriminator 1) net/socket.c:744 (discriminator 1) net/socket.c:2214 (discriminator 1))
__x64_sys_sendto (net/socket.c:2222)
do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1))
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Allocated by task 5192:
Freed by task 5192:
The buggy address belongs to the object at ffff888028c3c800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 24 bytes inside of
freed 1024-byte region [ffff888028c3c800, ffff888028c3cc00)
The buggy address belongs to the physical page:
Kernel panic - not syncing: KASAN: panic_on_warn set ...


---
The report format is based on syzbot bug report.

This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.

For any issue with this report, reach out to cedalion@xxxxxxx

If the report is already addressed, let us know by replying with:
#co fix: <commit hash>

If the report is a duplicate of another one, reply with:
#co dup: <lore link>

If you want to undo deduplication, reply with:
#co undup