Skip to content

Commit 7c46bd8

Browse files
kuba-mookuba-moo
committed
Johannes Berg says: ==================== Just a few updates: - cfg80211: - guarantee pmsr work is cancelled - mac80211: - reject TDLS operations on non-TDLS stations - fix crash in AP_VLAN bandwidth change - fix leak or double-free on some TX preparation failures - remove keys needed for beacons _after_ stopping those - fix debugfs static branch race - avoid underflow in inactive time - fix another NULL dereference in mesh on invalid frames - ti/wlcore: avoid infinite realloc loop * tag 'wireless-2026-03-18' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom wifi: mac80211: fix NULL deref in mesh_matches_local() wifi: mac80211: check tdls flag in ieee80211_tdls_oper wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations wifi: mac80211: use jiffies_delta_to_msecs() for sta_info inactive times wifi: mac80211: remove keys after disabling beaconing wifi: mac80211_hwsim: fully initialise PMSR capabilities ==================== Link: https://patch.msgid.link/20260318172515.381148-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 parents 605b524 + d5ad6ab commit 7c46bd8

13 files changed

Lines changed: 36 additions & 32 deletions

File tree

‎drivers/net/wireless/ath/ath9k/channel.c‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1006,7 +1006,7 @@ static void ath_scan_send_probe(struct ath_softc *sc,
10061006
skb_set_queue_mapping(skb, IEEE80211_AC_VO);
10071007

10081008
if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, NULL))
1009-
goto error;
1009+
return;
10101010

10111011
txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
10121012
if (ath_tx_start(sc->hw, skb, &txctl))
@@ -1119,10 +1119,8 @@ ath_chanctx_send_vif_ps_frame(struct ath_softc *sc, struct ath_vif *avp,
11191119

11201120
skb->priority = 7;
11211121
skb_set_queue_mapping(skb, IEEE80211_AC_VO);
1122-
if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta)) {
1123-
dev_kfree_skb_any(skb);
1122+
if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta))
11241123
return false;
1125-
}
11261124
break;
11271125
default:
11281126
return false;

‎drivers/net/wireless/mediatek/mt76/scan.c‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,10 +63,8 @@ mt76_scan_send_probe(struct mt76_dev *dev, struct cfg80211_ssid *ssid)
6363

6464
rcu_read_lock();
6565

66-
if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL)) {
67-
ieee80211_free_txskb(phy->hw, skb);
66+
if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL))
6867
goto out;
69-
}
7068

7169
info = IEEE80211_SKB_CB(skb);
7270
if (req->no_cck)

‎drivers/net/wireless/ti/wlcore/tx.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -210,7 +210,7 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct wl12xx_vif *wlvif,
210210
if (skb_headroom(skb) < (total_len - skb->len) &&
211211
pskb_expand_head(skb, (total_len - skb->len), 0, GFP_ATOMIC)) {
212212
wl1271_free_tx_id(wl, id);
213-
return -EAGAIN;
213+
return -ENOMEM;
214214
}
215215
desc = skb_push(skb, total_len - skb->len);
216216

‎drivers/net/wireless/virtual/mac80211_hwsim.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3021,7 +3021,6 @@ static void hw_scan_work(struct work_struct *work)
30213021
hwsim->tmp_chan->band,
30223022
NULL)) {
30233023
rcu_read_unlock();
3024-
kfree_skb(probe);
30253024
continue;
30263025
}
30273026

@@ -6489,7 +6488,7 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
64896488
if (info->attrs[HWSIM_ATTR_PMSR_SUPPORT]) {
64906489
struct cfg80211_pmsr_capabilities *pmsr_capa;
64916490

6492-
pmsr_capa = kmalloc_obj(*pmsr_capa);
6491+
pmsr_capa = kzalloc_obj(*pmsr_capa);
64936492
if (!pmsr_capa) {
64946493
ret = -ENOMEM;
64956494
goto out_free;

‎include/net/mac80211.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7407,7 +7407,9 @@ void ieee80211_report_wowlan_wakeup(struct ieee80211_vif *vif,
74077407
* @band: the band to transmit on
74087408
* @sta: optional pointer to get the station to send the frame to
74097409
*
7410-
* Return: %true if the skb was prepared, %false otherwise
7410+
* Return: %true if the skb was prepared, %false otherwise.
7411+
* On failure, the skb is freed by this function; callers must not
7412+
* free it again.
74117413
*
74127414
* Note: must be called under RCU lock
74137415
*/

‎net/mac80211/cfg.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1904,12 +1904,6 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev,
19041904

19051905
__sta_info_flush(sdata, true, link_id, NULL);
19061906

1907-
ieee80211_remove_link_keys(link, &keys);
1908-
if (!list_empty(&keys)) {
1909-
synchronize_net();
1910-
ieee80211_free_key_list(local, &keys);
1911-
}
1912-
19131907
ieee80211_stop_mbssid(sdata);
19141908
RCU_INIT_POINTER(link_conf->tx_bss_conf, NULL);
19151909

@@ -1921,6 +1915,12 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev,
19211915
ieee80211_link_info_change_notify(sdata, link,
19221916
BSS_CHANGED_BEACON_ENABLED);
19231917

1918+
ieee80211_remove_link_keys(link, &keys);
1919+
if (!list_empty(&keys)) {
1920+
synchronize_net();
1921+
ieee80211_free_key_list(local, &keys);
1922+
}
1923+
19241924
if (sdata->wdev.links[link_id].cac_started) {
19251925
chandef = link_conf->chanreq.oper;
19261926
wiphy_hrtimer_work_cancel(wiphy, &link->dfs_cac_timer_work);

‎net/mac80211/chan.c‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -561,14 +561,16 @@ static void ieee80211_chan_bw_change(struct ieee80211_local *local,
561561
rcu_read_lock();
562562
list_for_each_entry_rcu(sta, &local->sta_list,
563563
list) {
564-
struct ieee80211_sub_if_data *sdata = sta->sdata;
564+
struct ieee80211_sub_if_data *sdata;
565565
enum ieee80211_sta_rx_bandwidth new_sta_bw;
566566
unsigned int link_id;
567567

568568
if (!ieee80211_sdata_running(sta->sdata))
569569
continue;
570570

571-
for (link_id = 0; link_id < ARRAY_SIZE(sta->sdata->link); link_id++) {
571+
sdata = get_bss_sdata(sta->sdata);
572+
573+
for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
572574
struct ieee80211_link_data *link =
573575
rcu_dereference(sdata->link[link_id]);
574576
struct ieee80211_bss_conf *link_conf;

‎net/mac80211/debugfs.c‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -320,7 +320,6 @@ static ssize_t aql_enable_read(struct file *file, char __user *user_buf,
320320
static ssize_t aql_enable_write(struct file *file, const char __user *user_buf,
321321
size_t count, loff_t *ppos)
322322
{
323-
bool aql_disabled = static_key_false(&aql_disable.key);
324323
char buf[3];
325324
size_t len;
326325

@@ -335,15 +334,12 @@ static ssize_t aql_enable_write(struct file *file, const char __user *user_buf,
335334
if (len > 0 && buf[len - 1] == '\n')
336335
buf[len - 1] = 0;
337336

338-
if (buf[0] == '0' && buf[1] == '\0') {
339-
if (!aql_disabled)
340-
static_branch_inc(&aql_disable);
341-
} else if (buf[0] == '1' && buf[1] == '\0') {
342-
if (aql_disabled)
343-
static_branch_dec(&aql_disable);
344-
} else {
337+
if (buf[0] == '0' && buf[1] == '\0')
338+
static_branch_enable(&aql_disable);
339+
else if (buf[0] == '1' && buf[1] == '\0')
340+
static_branch_disable(&aql_disable);
341+
else
345342
return -EINVAL;
346-
}
347343

348344
return count;
349345
}

‎net/mac80211/mesh.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,9 @@ bool mesh_matches_local(struct ieee80211_sub_if_data *sdata,
7979
* - MDA enabled
8080
* - Power management control on fc
8181
*/
82+
if (!ie->mesh_config)
83+
return false;
84+
8285
if (!(ifmsh->mesh_id_len == ie->mesh_id_len &&
8386
memcmp(ifmsh->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
8487
(ifmsh->mesh_pp_id == ie->mesh_config->meshconf_psel) &&

‎net/mac80211/sta_info.c‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2782,7 +2782,9 @@ static void sta_set_link_sinfo(struct sta_info *sta,
27822782
}
27832783

27842784
link_sinfo->inactive_time =
2785-
jiffies_to_msecs(jiffies - ieee80211_sta_last_active(sta, link_id));
2785+
jiffies_delta_to_msecs(jiffies -
2786+
ieee80211_sta_last_active(sta,
2787+
link_id));
27862788

27872789
if (!(link_sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES64) |
27882790
BIT_ULL(NL80211_STA_INFO_TX_BYTES)))) {
@@ -3015,7 +3017,8 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,
30153017
sinfo->connected_time = ktime_get_seconds() - sta->last_connected;
30163018
sinfo->assoc_at = sta->assoc_at;
30173019
sinfo->inactive_time =
3018-
jiffies_to_msecs(jiffies - ieee80211_sta_last_active(sta, -1));
3020+
jiffies_delta_to_msecs(jiffies -
3021+
ieee80211_sta_last_active(sta, -1));
30193022

30203023
if (!(sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES64) |
30213024
BIT_ULL(NL80211_STA_INFO_TX_BYTES)))) {

0 commit comments

Comments
 (0)