From 008aa66b315dbc5761eaa5d3a070f0640504e313 Mon Sep 17 00:00:00 2001 From: Nguyen Dinh Phi Date: Thu, 5 Aug 2021 17:12:04 +0800 Subject: [PATCH] cfg80211: Fix possible memory leak in function cfg80211_bss_update stable inclusion from linux-4.19.201 commit 672f6ea510391a85dfce3362ad5d832bce447c14 -------------------------------- commit f9a5c358c8d26fed0cc45f2afc64633d4ba21dff upstream. When we exceed the limit of BSS entries, this function will free the new entry, however, at this time, it is the last door to access the inputed ies, so these ies will be unreferenced objects and cause memory leak. Therefore we should free its ies before deallocating the new entry, beside of dropping it from hidden_list. Signed-off-by: Nguyen Dinh Phi Link: https://lore.kernel.org/r/20210628132334.851095-1-phind.uet@gmail.com Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman Signed-off-by: Yang Yingliang --- net/wireless/scan.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 67b2747ad9ef..d871349036a5 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -1029,16 +1029,14 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev, * be grouped with this beacon for updates ... */ if (!cfg80211_combine_bsses(rdev, new)) { - kfree(new); + bss_ref_put(rdev, new); goto drop; } } if (rdev->bss_entries >= bss_entries_limit && !cfg80211_bss_expire_oldest(rdev)) { - if (!list_empty(&new->hidden_list)) - list_del(&new->hidden_list); - kfree(new); + bss_ref_put(rdev, new); goto drop; } -- GitLab