github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: cfg80211: publish PMSR request before starting the driver

Browse Source 
nl80211_pmsr_start() assigns the request cookie, calls the driver's
->start_pmsr() callback, and only then adds the request to
wdev->pmsr_list, without holding pmsr_lock for the addition.

mac80211_hwsim saves the request in its start callback and returns. Since
nl80211 uses parallel_ops, an immediate REPORT_PMSR can then run before
nl80211_pmsr_start() reaches its post-start list_add_tail(). hwsim also
dispatches reports from its virtio receive workqueue. Completion removes
the request from wdev->pmsr_list under pmsr_lock and frees it.

Thus completion can precede publication, race the unlocked list mutation,
or free the request before nl80211_pmsr_start() reads req->cookie for the
netlink reply.

Add the request to wdev->pmsr_list under pmsr_lock before calling the
driver, and use a cookie value saved before the call so the request is not
dereferenced after a successful start. On an error return the driver has
not retained or completed the request, so remove it from the list under the
lock and free it.

Fixes: 9bb7e0f24e ("cfg80211: add peer measurement with FTM initiator API")
Link: https://lore.kernel.org/all/20260723010916.76433-1-enderaoelyther@gmail.com/
Assisted-by: Codex:gpt-5
Assisted-by: Claude:opus-4.8
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260723202223.99661-1-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Zhao Li 2026-07-24 04:22:23 +08:00 committed by Johannes Berg
parent 99a948382a
commit 0451392295
1 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
net/wireless/pmsr.c
View File

@ -420,6 +420,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
const struct cfg80211_pmsr_capabilities *capa;
struct cfg80211_pmsr_request *req;
struct nlattr *peers, *peer;
u64 cookie;
capa = rdev->wiphy.pmsr_capa;
@ -521,14 +522,27 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
}
req->cookie = cfg80211_assign_cookie(rdev);
req->nl_portid = info->snd_portid;
cookie = req->cookie;
/*
* Add to the list before the driver call; under races or broken
* drivers, completion may free the request before rdev_start_pmsr()
* returns. Use the saved cookie below.
*/
spin_lock_bh(&wdev->pmsr_lock);
list_add_tail(&req->list, &wdev->pmsr_list);
spin_unlock_bh(&wdev->pmsr_lock);
err = rdev_start_pmsr(rdev, wdev, req);
if (err)
if (err) {
/* An error return leaves the request owned by this path. */
spin_lock_bh(&wdev->pmsr_lock);
list_del(&req->list);
spin_unlock_bh(&wdev->pmsr_lock);
goto out_err;
}
list_add_tail(&req->list, &wdev->pmsr_list);
nl_set_extack_cookie_u64(info->extack, req->cookie);
nl_set_extack_cookie_u64(info->extack, cookie);
return 0;
out_err:
kfree(req);