github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: mac80211_hwsim: clear PMSR request state on abort

Browse Source 
mac80211_hwsim saves the in-flight cfg80211 PMSR request and its wdev
in data->pmsr_request / data->pmsr_request_wdev when a measurement
starts, and clears them only when it reports completion.

mac80211_hwsim_abort_pmsr() never cleared that saved state. cfg80211
owns the request and frees it once the abort callback returns
(cfg80211_pmsr_process_abort() calls rdev_abort_pmsr() then
kfree(req)), so after an abort data->pmsr_request dangles. A later
hwsim PMSR report then dereferences the freed request in
hwsim_pmsr_report_nl() and completes it; a use-after-free.

Clear data->pmsr_request and data->pmsr_request_wdev once the abort
matches the active request. Move the wmediumd/virtio notification check
below the clear so the saved state is dropped even when no notification
is sent.

Assisted-by: Codex:gpt-5
Assisted-by: Claude:opus-4.8
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260708195911.84365-2-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Zhao Li 2026-07-09 03:59:04 +08:00 committed by Johannes Berg
parent aeea930c7a
commit 37a77bd139
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/net/wireless/virtual/mac80211_hwsim_main.c
View File

@ -3831,9 +3831,6 @@ static void mac80211_hwsim_abort_pmsr(struct ieee80211_hw *hw,
int err = 0;
data = hw->priv;
_portid = READ_ONCE(data->wmediumd);
if (!_portid && !hwsim_virtio_enabled)
return;
mutex_lock(&data->mutex);
@ -3842,6 +3839,13 @@ static void mac80211_hwsim_abort_pmsr(struct ieee80211_hw *hw,
goto out;
}
data->pmsr_request = NULL;
data->pmsr_request_wdev = NULL;
_portid = READ_ONCE(data->wmediumd);
if (!_portid && !hwsim_virtio_enabled)
goto out;
skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
if (!skb) {
err = -ENOMEM;