[PATCH] wifi: cfg80211: release rejected nontransmitted BSS reference

[PATCH] wifi: cfg80211: release rejected nontransmitted BSS reference

[Zhao Li]

Repeated MBSSID reports without an SSID can leak BSS entries outside the
scan cache, where the BSS entry limit cannot account for them.

__cfg80211_bss_update() returns a referenced BSS. If adding it to the
transmitting BSS list fails, unlinking drops the cache reference, but the
caller reference is lost when res is cleared.

Release the caller reference before discarding the unlinked BSS.

LLM assistance was used to find the bug and review.

Fixes: 0b7808818cb9 ("wifi: cfg80211: fix BSS refcounting bugs")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
Validation: A W=1 module build with MODPOST passed. In a QEMU
guest, 20000 rejected BSS reports retained 589--594 bytes each before the
change and 14--19 bytes each after it; the transmitting-BSS reference
ended at 20001 and 1 respectively. A reproducer is available on request.
Sparse C=2 passed. Targeted Smatch introduced no new diagnostics.

 net/wireless/scan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index d35c826c4b1a..36f8521f8d60 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -2452,6 +2452,7 @@ cfg80211_inform_single_bss_data(struct wiphy *wiphy,
 		if (cfg80211_add_nontrans_list(data->source_bss, &res->pub)) {
 			if (__cfg80211_unlink_bss(rdev, res)) {
 				rdev->bss_generation++;
+				bss_ref_put(rdev, res);
 				res = NULL;
 			}
 		}

base-commit: 25e73f1d6868c759c8eb56cad4e411692c5341b4
-- 
2.56.0