From 37a77bd1395e8261d1760ae39c7f5eb637300550 Mon Sep 17 00:00:00 2001 From: Zhao Li Date: Thu, 9 Jul 2026 03:59:04 +0800 Subject: [PATCH] wifi: mac80211_hwsim: clear PMSR request state on abort mac80211_hwsim saves the in-flight cfg80211 PMSR request and its wdev in data->pmsr_request / data->pmsr_request_wdev when a measurement starts, and clears them only when it reports completion. mac80211_hwsim_abort_pmsr() never cleared that saved state. cfg80211 owns the request and frees it once the abort callback returns (cfg80211_pmsr_process_abort() calls rdev_abort_pmsr() then kfree(req)), so after an abort data->pmsr_request dangles. A later hwsim PMSR report then dereferences the freed request in hwsim_pmsr_report_nl() and completes it; a use-after-free. Clear data->pmsr_request and data->pmsr_request_wdev once the abort matches the active request. Move the wmediumd/virtio notification check below the clear so the saved state is dropped even when no notification is sent. Assisted-by: Codex:gpt-5 Assisted-by: Claude:opus-4.8 Signed-off-by: Zhao Li Link: https://patch.msgid.link/20260708195911.84365-2-enderaoelyther@gmail.com Signed-off-by: Johannes Berg --- drivers/net/wireless/virtual/mac80211_hwsim_main.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c index 06ca47f01fd7..d5e3d19ccc3e 100644 --- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c +++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c @@ -3831,9 +3831,6 @@ static void mac80211_hwsim_abort_pmsr(struct ieee80211_hw *hw, int err = 0; data = hw->priv; - _portid = READ_ONCE(data->wmediumd); - if (!_portid && !hwsim_virtio_enabled) - return; mutex_lock(&data->mutex); @@ -3842,6 +3839,13 @@ static void mac80211_hwsim_abort_pmsr(struct ieee80211_hw *hw, goto out; } + data->pmsr_request = NULL; + data->pmsr_request_wdev = NULL; + + _portid = READ_ONCE(data->wmediumd); + if (!_portid && !hwsim_virtio_enabled) + goto out; + skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL); if (!skb) { err = -ENOMEM;