CVE-2024-26896

In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: fix memory leak when starting AP Kmemleak reported this error: unreferenced object 0xd73d1180 (size 184): comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.245s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00 ................ backtrace: [ ] kmem_cache_alloc+0x20c/0x5ac [ ] __alloc_skb+0x144/0x170 [ ] __netdev_alloc_skb+0x50/0x180 [ ] __ieee80211_beacon_get+0x290/0x4d4 [mac80211] [ ] ieee80211_beacon_get_tim+0x54/0x18c [mac80211] [ ] wfx_start_ap+0xc8/0x234 [wfx] [ ] ieee80211_start_ap+0x404/0x6b4 [mac80211] [ ] nl80211_start_ap+0x76c/0x9e0 [cfg80211] [ ] genl_rcv_msg+0x198/0x378 [ ] netlink_rcv_skb+0xd0/0x130 [ ] genl_rcv+0x34/0x44 [ ] netlink_unicast+0x1b4/0x258 [ ] netlink_sendmsg+0x1e8/0x428 [ ] ____sys_sendmsg+0x1e0/0x274 [ ] ___sys_sendmsg+0x80/0xb4 [ ] __sys_sendmsg+0x64/0xa8 unreferenced object 0xce087000 (size 1024): comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.246s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [ ] __kmalloc_track_caller+0x230/0x600 [ ] kmalloc_reserve.constprop.0+0x30/0x74 [ ] __alloc_skb+0xa0/0x170 [ ] __netdev_alloc_skb+0x50/0x180 [ ] __ieee80211_beacon_get+0x290/0x4d4 [mac80211] [ ] ieee80211_beacon_get_tim+0x54/0x18c [mac80211] [ ] wfx_start_ap+0xc8/0x234 [wfx] [ ] ieee80211_start_ap+0x404/0x6b4 [mac80211] [ ] nl80211_start_ap+0x76c/0x9e0 [cfg80211] [ ] genl_rcv_msg+0x198/0x378 [ ] netlink_rcv_skb+0xd0/0x130 [ ] genl_rcv+0x34/0x44 [ ] netlink_unicast+0x1b4/0x258 [ ] netlink_sendmsg+0x1e8/0x428 [ ] ____sys_sendmsg+0x1e0/0x274 [ ] ___sys_sendmsg+0x80/0xb4 However, since the kernel is build optimized, it seems the stack is not accurate. It appears the issue is related to wfx_set_mfp_ap(). The issue is obvious in this function: memory allocated by ieee80211_beacon_get() is never released. Fixing this leak makes kmemleak happy.