From dac727cdcdd22813e08bd6475724e83e057ac675 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 25 Feb 2025 22:59:22 +0900 Subject: [PATCH] wifi: cfg80211: clear wdev->cqm_config pointer on free BugLink: https://bugs.launchpad.net/bugs/2099996 commit d5fee261dfd9e17b08b1df8471ac5d5736070917 upstream. When we free wdev->cqm_config when unregistering, we also need to clear out the pointer since the same wdev/netdev may get re-registered in another network namespace, then destroyed later, running this code again, which results in a double-free. Reported-by: syzbot+36218cddfd84b5cc263e@syzkaller.appspotmail.com Fixes: 37c20b2effe9 ("wifi: cfg80211: fix cqm_config access race") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20241022161742.7c34b2037726.I121b9cdb7eb180802eafc90b493522950d57ee18@changeid Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman CVE-2024-50235 Signed-off-by: Koichiro Den Signed-off-by: Stefan Bader --- net/wireless/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/wireless/core.c b/net/wireless/core.c index 4b1f45e3070e..52863cb36d56 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -1231,6 +1231,7 @@ static void _cfg80211_unregister_wdev(struct wireless_dev *wdev, /* deleted from the list, so can't be found from nl80211 any more */ cqm_config = rcu_access_pointer(wdev->cqm_config); kfree_rcu(cqm_config, rcu_head); + RCU_INIT_POINTER(wdev->cqm_config, NULL); /* * Ensure that all events have been processed and