From: "Ömer Mete Kaya" <omermetekaya0@gmail.com>
To: linux-wireless@vger.kernel.org
Cc: johannes@sipsolutions.net, kvalo@kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
horms@kernel.org
Subject: Re: [PATCH v2] wifi: cfg80211: avoid holding rtnl_mutex across all cfg80211_leave() calls
Date: Sun, 6 Sep 2026 03:25:45 +0300 [thread overview]
Message-ID: <20260906002657.620076-1-omermetekaya0@gmail.com> (raw)
In-Reply-To: <20260903151542.486376-2-omermetekaya0@gmail.com>
Thank you for the review, Simon! You are correct, the previous v2
had a UAF window between rcu_read_unlock() and rtnl_lock().
v3 fixes this by taking a snapshot of cfg80211_rdev_list under RCU
with get_device() holding a reference on each rdev, preventing freeing
between per-device rtnl acquisitions. After acquiring rtnl per-device,
wiphy.registered is checked (set under rtnl in wiphy_unregister()) to
safely skip any unregistered device.
Changes in v3:
- Replace RCU drop/reacquire pattern with get_device() snapshot
- Add wiphy.registered check after per-device rtnl_lock()
- Add Fixes: f7e60032c661 tag
- Update commit message to describe new approach
In-Reply-To: <20260903151542.486376-2-omermetekaya0@gmail.com>
next prev parent reply other threads:[~2026-09-06 0:27 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-03 11:13 [PATCH] wifi: cfg80211: avoid holding rtnl_mutex across all cfg80211_leave() calls Ömer Mete Kaya
2026-09-03 15:13 ` Ömer Mete Kaya
2026-09-03 15:13 ` [PATCH v2] " Ömer Mete Kaya
2026-09-05 18:45 ` Simon Horman
2026-09-06 0:25 ` Ömer Mete Kaya [this message]
2026-09-06 0:25 ` [PATCH] " Ömer Mete Kaya
2026-09-06 11:57 ` Johannes Berg
2026-09-07 16:38 ` Ben Greear
2026-09-08 8:58 ` Ömer Mete Kaya
2026-09-08 16:50 ` Ben Greear
2026-09-08 19:52 ` Ömer Mete Kaya
2026-09-08 20:09 ` Ben Greear
2026-09-08 22:32 ` Ömer Mete Kaya
2026-09-08 23:40 ` Ben Greear
2026-09-09 17:54 ` Ömer Mete Kaya
2026-09-09 15:26 ` netdev-bot+sashiko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260906002657.620076-1-omermetekaya0@gmail.com \
--to=omermetekaya0@gmail.com \
--cc=horms@kernel.org \
--cc=johannes@sipsolutions.net \
--cc=kvalo@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.