Re: [PATCH 6.1.y] wifi: cfg80211: release locks on error in cfg80211_wext_siwgenie()

["Wentao Guan" <guanwentao@uniontech.com>]

Hi,

> On Mon, Oct 12, 2026 at 11:42:46PM +0800, Wentao Guan wrote:
> > This error path returns while wdev_lock() is still held, so one
> > malformed IE request can permanently block later operations on this
> > wiphy. Route the error through out to release the lock.
> >
> > Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
> > Closes: https://lore.kernel.org/all/93db0eae-f479-4343-a126-59987ae0dc22@oracle.com/
> > Fixes: 8b921a899346 ("wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()")
> > Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
> > ---
> >  net/wireless/wext-sme.c | 6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
> > index be121fa36c514..ba6d8827f64b3 100644
> > --- a/net/wireless/wext-sme.c
> > +++ b/net/wireless/wext-sme.c
> > @@ -352,8 +352,10 @@ int cfg80211_wext_siwgenie(struct net_device *dev,
> >  /* nothing */
> >  }
> > 
> > - if (!for_each_element_completed(elem, extra, ie_len))
> > - return -EINVAL;
> > + if (!for_each_element_completed(elem, extra, ie_len)) {
> > + err = -EINVAL;
> > + goto out;
> > + }
> > 
> >  ie = kmemdup(extra, ie_len, GFP_KERNEL);
> >  if (!ie) {
> > --
> > 2.39.5
> >
> >
> 
> <formletter>
> 
> This is not the correct way to submit patches for inclusion in the
> stable kernel tree.  Please read:
>    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
> for how to do this properly.
> 
> </formletter>

> It or an equivalent fix must already exist in Linux mainline (upstream).
This is a trival fix for these stable trees, the problem is not existed in mainline 

> It must be obviously correct and tested.
It is clearly right.

> It cannot be bigger than 100 lines, with context.
It is small./ +4 lines -2 lines

> It must follow the Documentation/process/submitting-patches.rst rules.
Its fixes tags point to the stable backport commit ids.

>It must either fix a real bug that bothers people or just add a device ID. To elaborate on the former:
> It fixes a problem like an oops, a hang, data corruption, a real security issue, a hardware quirk, a build error (but not for things marked CONFIG_BROKEN), or some “oh, that’s not good” issue.
Its fixes a lock with out unlock, and we no need to backport f42d22d3f79639 
("wifi: cfg80211: define and use wiphy guard")
and guard for older kernel tree.

BRs
Wentao Guan