From: Zhao Li <enderaoelyther@gmail.com>
To: Johannes Berg <johannes@sipsolutions.net>
Cc: "John W. Linville" <linville@tuxdriver.com>,
Javier Lopez <jlopex@gmail.com>,
Jukka Rissanen <jukka.rissanen@linux.intel.com>,
linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: [PATCH 1/2] wifi: mac80211_hwsim: ignore non-generic netlink releases
Date: Wed, 28 Oct 2026 22:17:50 +0800 [thread overview]
Message-ID: <20261028141751.6728-2-enderaoelyther@gmail.com> (raw)
In-Reply-To: <20261028141751.6728-1-enderaoelyther@gmail.com>
Closing an unrelated netlink socket can remove mac80211_hwsim radios or
clear the active wmediumd registration when its port ID matches a generic
netlink socket.
mac80211_hwsim_netlink_notify() handles every NETLINK_URELEASE event,
but netlink port IDs are scoped by protocol. The notifier therefore treats
a release from another protocol as a MAC80211_HWSIM socket release.
Ignore release notifications unless they come from NETLINK_GENERIC.
LLM assistance was used to find the bug and review.
Fixes: 7882513bacb1 ("mac80211_hwsim driver support userspace frame tx/rx")
Fixes: e9ed49bf4c2c ("mac80211-hwsim: Add support for HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
Validation: A W=1 module build with MODPOST passed. Not
reproduced; source review confirmed that netlink port IDs are scoped by
protocol.
Sparse C=2 passed. Targeted Smatch introduced no new diagnostics.
drivers/net/wireless/virtual/mac80211_hwsim_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
index b9446577ff49..fcbc7f4355bd 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
@@ -7197,7 +7197,7 @@ static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
{
struct netlink_notify *notify = _notify;
- if (state != NETLINK_URELEASE)
+ if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
return NOTIFY_DONE;
remove_user_radios(notify->portid, hwsim_net_get_netgroup(notify->net));
--
2.56.0
next prev parent reply other threads:[~2026-10-28 14:18 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-28 14:17 [PATCH 0/2] wifi: mac80211_hwsim: fix netlink release and radio removal races Zhao Li
2026-10-28 14:17 ` Zhao Li [this message]
2026-10-28 14:17 ` [PATCH 2/2] wifi: mac80211_hwsim: serialize radio removal with frame commands Zhao Li
2026-10-29 8:38 ` [syzbot ci] Re: wifi: mac80211_hwsim: fix netlink release and radio removal races syzbot ci
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261028141751.6728-2-enderaoelyther@gmail.com \
--to=enderaoelyther@gmail.com \
--cc=jlopex@gmail.com \
--cc=johannes@sipsolutions.net \
--cc=jukka.rissanen@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.