github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: mac80211: acquire wiphy lock for unlisted sdata teardown

Browse Source 
When netdev registration fails or an interface cannot be moved out of a
dying network namespace, the netdev core calls ->ndo_uninit()
(ieee80211_uninit) with RTNL held.

However, ieee80211_uninit() calls ieee80211_teardown_sdata() without
holding wiphy_lock. During teardown, ieee80211_free_keys() invokes
wiphy_delayed_work_cancel(), which triggers a lockdep warning:

  WARNING: CPU: 0 PID: 6112 at net/wireless/core.c:1839 wiphy_delayed_work_cancel+0x85/0xb0
  ...
  Call Trace:
   ieee80211_free_keys+0x31a/0x3c0 net/mac80211/key.c:380
   ieee80211_teardown_sdata+0x2b8/0x10f0 net/mac80211/iface.c:928
   ieee80211_uninit+0x3f/0x50 net/mac80211/iface.c:954
   rollback_registered_many+0xa5c/0xef0 net/core/dev.c:10065

In the normal deletion path (ieee80211_del_virtual_intf), both RTNL and
wiphy_lock are held when ieee80211_teardown_sdata() runs, and the sdata
is removed from local->interfaces.

Change ieee80211_unlist_sdata() to return a boolean indicating whether the
sdata was present in the list, and acquire wiphy_lock in ieee80211_uninit()
only if the interface is actually being unlisted here.

Reported-by: syzbot+e9cbd080a7801f06cf08@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e9cbd080a7801f06cf08
Tested-by: syzbot+e9cbd080a7801f06cf08@syzkaller.appspotmail.com
Signed-off-by: Raj Ojha <rajojha047@gmail.com>
Link: https://patch.msgid.link/20261003112741.52-1-rajojha047@gmail.com
[dissolve ieee80211_unlist_sdata() to avoid weird locking]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Raj Ojha 2026-10-03 16:57:41 +05:30 committed by Johannes Berg
parent 2d03b83ef7
commit a79d7328ba
1 changed files with 12 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
net/mac80211/iface.c
View File

@ -927,32 +927,30 @@ static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
}
}
/*
* The netdev can be unregistered without mac80211 doing it, e.g. by the netdev
* core when cfg80211 couldn't move it out of a network namespace that's being
* destroyed. Drop it from the interface list either way.
*/
static void ieee80211_unlist_sdata(struct ieee80211_sub_if_data *sdata)
static void ieee80211_uninit(struct net_device *dev)
{
struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
struct ieee80211_local *local = sdata->local;
struct ieee80211_sub_if_data *iter;
ASSERT_RTNL();
/*
* The netdev can be unregistered without mac80211 doing it, e.g. by the
* netdev core when cfg80211 couldn't move it out of a network namespace
* that's being destroyed. If so, it's still listed and the wiphy mutex
* isn't held yet.
*/
list_for_each_entry(iter, &local->interfaces, list) {
if (iter != sdata)
continue;
guard(mutex)(&local->iflist_mtx);
list_del_rcu(&sdata->list);
guard(wiphy)(local->hw.wiphy);
scoped_guard(mutex, &local->iflist_mtx)
list_del_rcu(&sdata->list);
ieee80211_teardown_sdata(sdata);
return;
}
}
static void ieee80211_uninit(struct net_device *dev)
{
struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
ieee80211_unlist_sdata(sdata);
ieee80211_teardown_sdata(sdata);
}