wifi: cfg80211: fix double free for link_sinfo in nl80211_station_dump()
authorSarika Sharma <quic_sarishar@quicinc.com>
Mon, 14 Jul 2025 08:44:05 +0000 (14:14 +0530)
committerJohannes Berg <johannes.berg@intel.com>
Tue, 15 Jul 2025 09:05:13 +0000 (11:05 +0200)
commit9a44b5e36cd699fdd2150a63fab225ac510c1971
treeda6d9fbd83d2d01a0d1d84a07ac5e52b1339e70a
parente9a896d498506af16d52ee33b80c1cdb4f36350d
wifi: cfg80211: fix double free for link_sinfo in nl80211_station_dump()

Currently, the link_sinfo structure is being freed twice in
nl80211_dump_station(), once after the send_station() call and again
in the error handling path. This results in a double free of both
link_sinfo and link_sinfo->pertid, which might lead to undefined
behavior or kernel crashes.

Hence, fix by ensuring cfg80211_sinfo_release_content() is only
invoked once during execution of nl80211_station_dump().

Fixes: 49e47223ecc4 ("wifi: cfg80211: allocate memory for link_station info structure")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/81f30515-a83d-4b05-a9d1-e349969df9e9@sabinyo.mountain/
Reported-by: syzbot+4ba6272678aa468132c8@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68655325.a70a0220.5d25f.0316.GAE@google.com
Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
Link: https://patch.msgid.link/20250714084405.178066-1-quic_sarishar@quicinc.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/wireless/nl80211.c