[PATCH] cfg80211: fix double-free of shared hidden-group beacon IEs

[Yilin Zhang]

cfg80211_update_known_bss() adopts new->pub.beacon_ies without
checking whether new is a hidden group member.

cfg80211_update_assoc_bss_entry() can pass such a member as new on a
CSA channel switch, so the same IEs get two owners and are freed
twice.

Same issue as commit 26e84445f02c ("wifi: cfg80211: fix
use-after-free in cmp_bss()"), which fixed only the drop path.

Reported-by: Kimi Security Team <bug-report@xxxxxxxxxxx>
Fixes: 0afd425b1b64 ("cfg80211: fix duplicated scan entries after channel switch")
Signed-off-by: Yilin Zhang <yilinzhang@xxxxxxxxxxx>
---
 net/wireless/scan.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 071083c..1fbbcda 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1937,6 +1937,9 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
 			return false;
 		}
 
+		if (new->pub.hidden_beacon_bss)
+			return true;
+
 		old = rcu_access_pointer(known->pub.beacon_ies);
 
 		rcu_assign_pointer(known->pub.beacon_ies, new->pub.beacon_ies);
-- 
2.34.1