From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793213149; b=CcU6DHGkhwnYMfP3pxMAclqSb9bOOegZRC4FvT5jSXDrRIuQkB+/Tn9BHAtr5JZ0XS3U Pw5VXt3kA6CE5vWy3fUKz3+BPjRqgthTp28vKHgHiXMQEC7gObMvOMbJiILQa2E2v7vsP Z9ew1nXRfAej5l+HxOeaaN3axlDX6f2pxiFa59j3b+ET8MgbB5eGQ9tDdGTggKH+Jsyc3 qHkKwKbnpcizhdl4Bl/C2ea1x3tJG4EYJXEAWLWs5kcgNInPd0DFY3eK+AzYcZNJJUgZL Zx8A68uSYyfK+Jyjp59YReBGoxz6PaxspgpaX2uy1I9DIsnNozKd/wuqQUG/9M9ZPeg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793213149; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=phxnuAxjd7RuWWQjpoMj+KFUtwzRKGMkbLfuMqNzCNU=; b=TRDTaY1UF9EaSrmCRYnsGTTS3m8y54OzIX0MMxbRkJ5g3/2N99pQaD9ORSa71MbxmFZs 7v/WyjKwL0lffDyRdkn9KBGwtZRwYuCsSctYa9AGpAh5oUl8fX0VRhPq/Oy8AXc/GmsSp aLbkUxvO1O03H9RALhJpBoFYl0wte5cZwH2hF++CXiL0uE/5EkKGbuqkv4H8cfWk9T3+h j8XG5gz4VB9IGCCcScwncR4yLv+7UAaeWBsukrqlC1xksGMyaFKv0IwV5w0wj9bb6KK3M 2KqriYA292qk3T/Qg2pqf5BjcOlgnx8m5uMKIP5WJoJsukhdCDhGrSe9d1y916ryEww== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=SiBYgmLB; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 96B23606A31C; Wed, 28 Oct 2026 18:45:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=SiBYgmLB Received: by smtp.kernel.org (Postfix) with ESMTPSA id E71241F01825; Wed, 28 Oct 2026 18:45:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793213149; bh=phxnuAxjd7RuWWQjpoMj+KFUtwzRKGMkbLfuMqNzCNU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=SiBYgmLBSgmHFCyoNt7agm4y6vYyUaiilhSG6H+oSwSfsur4WWoDTcacqjLDOMfXS Kp9EaFdxfVMtdtZF5rtott/xiYIQnb3h3ghaahZwvyDZcYYgKK5b52yoI0waFk2nPq aDXXptosWZRw+ytoRS1Vjgc3Im9uurNMA5yxLvNc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Vega , Zhiling Zou , Johannes Berg , Sasha Levin Subject: [PATCH 6.1 0405/1887] wifi: mac80211: count only matching reservations in reserved switch Date: Wed, 28 Oct 2026 17:41:41 +0100 Message-ID: <20261028170508.449905402@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028170459.200466217@linuxfoundation.org> References: <20261028170459.200466217@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Zhiling Zou [ Upstream commit 437f3727b4fd715266c296435c116288f82666fd ] ieee80211_vif_use_reserved_switch() validates a replacement by counting assigned links on ctx->replace_ctx and treating reservations too broadly. A link can still be assigned to the old channel context while holding a reservation that belongs to a different replacement operation. That can make the current replacement appear complete too early. If another link finalizes first, the function can free the WILL_BE_REPLACED chanctx while the unmatched link and driver still use it, leading to a use-after-free in later beacon generation. Require an in-place reservation to point at the current replacement context, and require the reserved and assigned contexts to be the matching replacement pair, before counting or moving the link. Fixes: 5bcae31d9cb1 ("mac80211: implement multi-vif in-place reservations") Cc: stable@vger.kernel.org Reported-by: Vega Signed-off-by: Zhiling Zou Link: https://patch.msgid.link/4b6c4b8648ab1920c38a40be32c0b1a2797b4ac6.1785726007.git.zhilinz@nebusec.ai Signed-off-by: Johannes Berg [ sashal: Adapted iter.link accesses to direct link pointers in list-based loops. ] Signed-off-by: Sasha Levin --- net/mac80211/chan.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c index 81a6852cfb264..5838d391421e4 100644 --- a/net/mac80211/chan.c +++ b/net/mac80211/chan.c @@ -1389,7 +1389,8 @@ ieee80211_link_use_reserved_assign(struct ieee80211_link_data *link) } static bool -ieee80211_link_has_in_place_reservation(struct ieee80211_link_data *link) +ieee80211_link_has_in_place_reservation(struct ieee80211_link_data *link, + struct ieee80211_chanctx *ctx) { struct ieee80211_sub_if_data *sdata = link->sdata; struct ieee80211_chanctx *old_ctx, *new_ctx; @@ -1399,6 +1400,9 @@ ieee80211_link_has_in_place_reservation(struct ieee80211_link_data *link) new_ctx = link->reserved_chanctx; old_ctx = ieee80211_link_get_chanctx(link); + if (new_ctx != ctx) + return false; + if (!old_ctx) return false; @@ -1411,6 +1415,12 @@ ieee80211_link_has_in_place_reservation(struct ieee80211_link_data *link) if (new_ctx->replace_state != IEEE80211_CHANCTX_REPLACES_OTHER) return false; + if (new_ctx->replace_ctx != old_ctx) + return false; + + if (old_ctx->replace_ctx != new_ctx) + return false; + return true; } @@ -1460,7 +1470,7 @@ static int ieee80211_chsw_switch_vifs(struct ieee80211_local *local, list_for_each_entry(link, &ctx->reserved_links, reserved_chanctx_list) { - if (!ieee80211_link_has_in_place_reservation(link)) + if (!ieee80211_link_has_in_place_reservation(link, ctx)) continue; old_ctx = ieee80211_link_get_chanctx(link); @@ -1569,7 +1579,7 @@ static int ieee80211_vif_use_reserved_switch(struct ieee80211_local *local) list_for_each_entry(link, &ctx->replace_ctx->assigned_links, assigned_chanctx_list) { n_assigned++; - if (link->reserved_chanctx) { + if (ieee80211_link_has_in_place_reservation(link, ctx)) { n_reserved++; if (link->reserved_ready) n_ready++; @@ -1590,7 +1600,7 @@ static int ieee80211_vif_use_reserved_switch(struct ieee80211_local *local) ctx->conf.radar_enabled = false; list_for_each_entry(link, &ctx->reserved_links, reserved_chanctx_list) { - if (ieee80211_link_has_in_place_reservation(link) && + if (ieee80211_link_has_in_place_reservation(link, ctx) && !link->reserved_ready) return -EAGAIN; @@ -1664,7 +1674,7 @@ static int ieee80211_vif_use_reserved_switch(struct ieee80211_local *local) struct ieee80211_bss_conf *link_conf = link->conf; u32 changed = 0; - if (!ieee80211_link_has_in_place_reservation(link)) + if (!ieee80211_link_has_in_place_reservation(link, ctx)) continue; rcu_assign_pointer(link_conf->chanctx_conf, @@ -1717,7 +1727,8 @@ static int ieee80211_vif_use_reserved_switch(struct ieee80211_local *local) */ list_for_each_entry_safe(link, link_tmp, &ctx->reserved_links, reserved_chanctx_list) { - if (WARN_ON(ieee80211_link_has_in_place_reservation(link))) + if (WARN_ON(ieee80211_link_has_in_place_reservation(link, + ctx))) continue; if (WARN_ON(link->reserved_chanctx != ctx)) -- 2.53.0