iwlwifi-mld: Fix fw id leak in OOM case

iwlwifi-mld: Fix fw id leak in OOM case

[Ben Greear]

Hello Miriam,

I believe you will want to add something like this to your driver to clear the
fw_id_to_link_sta ID in case you hit the ENOMEM case.

I have no reason to believe I am actually hitting this error case, but I saw
this questionable code while looking for reasons for the use-after-free I am hitting.

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/sta.c b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
index 5fb2a46241e4..de9939ad1d58 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
@@ -535,13 +535,19 @@ iwl_mld_add_link_sta(struct iwl_mld *mld, struct ieee80211_link_sta *link_sta)
         ret = iwl_mld_allocate_link_sta_fw_id(mld, &fw_id, link_sta);
         if (ret)
                 return ret;

         if (link_sta == &link_sta->sta->deflink) {
                 mld_link_sta = &mld_sta->deflink;
         } else {
                 mld_link_sta = kzalloc(sizeof(*mld_link_sta), GFP_KERNEL);
-               if (!mld_link_sta)
+               if (!mld_link_sta) {
+                       IWL_ERR(mld, "mld-add-link-sta, OOM, clearing fw_id_to_link_sta[%d]\n",
+                               fw_id);
+                       RCU_INIT_POINTER(mld->fw_id_to_link_sta[fw_id], NULL);
                         return -ENOMEM;
+               }
         }

Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com

RE: iwlwifi-mld: Fix fw id leak in OOM case

[Korenblit, Miriam Rachel]

> -----Original Message-----
> From: Ben Greear <greearb@candelatech.com>
> Sent: Tuesday, March 3, 2026 1:07 AM
> To: linux-wireless <linux-wireless@vger.kernel.org>; Korenblit, Miriam Rachel
> <miriam.rachel.korenblit@intel.com>
> Subject: iwlwifi-mld: Fix fw id leak in OOM case
> 
> Hello Miriam,
> 
> I believe you will want to add something like this to your driver to clear the
> fw_id_to_link_sta ID in case you hit the ENOMEM case.
> 
> I have no reason to believe I am actually hitting this error case, but I saw this
> questionable code while looking for reasons for the use-after-free I am hitting.
> 
> diff --git a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
> b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
> index 5fb2a46241e4..de9939ad1d58 100644
> --- a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
> +++ b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
> @@ -535,13 +535,19 @@ iwl_mld_add_link_sta(struct iwl_mld *mld, struct
> ieee80211_link_sta *link_sta)
>          ret = iwl_mld_allocate_link_sta_fw_id(mld, &fw_id, link_sta);
>          if (ret)
>                  return ret;
> 
>          if (link_sta == &link_sta->sta->deflink) {
>                  mld_link_sta = &mld_sta->deflink;
>          } else {
>                  mld_link_sta = kzalloc(sizeof(*mld_link_sta), GFP_KERNEL);
> -               if (!mld_link_sta)
> +               if (!mld_link_sta) {
> +                       IWL_ERR(mld, "mld-add-link-sta, OOM, clearing
> fw_id_to_link_sta[%d]\n",
> +                               fw_id);
> +                       RCU_INIT_POINTER(mld->fw_id_to_link_sta[fw_id],
> + NULL);
>                          return -ENOMEM;
> +               }
>          }
> 
> Thanks,
> Ben
> 
> --
> Ben Greear <greearb@candelatech.com>
> Candela Technologies Inc  http://www.candelatech.com

Please send a patch

Re: iwlwifi-mld: Fix fw id leak in OOM case

[Ben Greear]

On 3/2/26 23:28, Korenblit, Miriam Rachel wrote:
> 
> 
>> -----Original Message-----
>> From: Ben Greear <greearb@candelatech.com>
>> Sent: Tuesday, March 3, 2026 1:07 AM
>> To: linux-wireless <linux-wireless@vger.kernel.org>; Korenblit, Miriam Rachel
>> <miriam.rachel.korenblit@intel.com>
>> Subject: iwlwifi-mld: Fix fw id leak in OOM case
>>
>> Hello Miriam,
>>
>> I believe you will want to add something like this to your driver to clear the
>> fw_id_to_link_sta ID in case you hit the ENOMEM case.
>>
>> I have no reason to believe I am actually hitting this error case, but I saw this
>> questionable code while looking for reasons for the use-after-free I am hitting.
>>
>> diff --git a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
>> b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
>> index 5fb2a46241e4..de9939ad1d58 100644
>> --- a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
>> +++ b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
>> @@ -535,13 +535,19 @@ iwl_mld_add_link_sta(struct iwl_mld *mld, struct
>> ieee80211_link_sta *link_sta)
>>           ret = iwl_mld_allocate_link_sta_fw_id(mld, &fw_id, link_sta);
>>           if (ret)
>>                   return ret;
>>
>>           if (link_sta == &link_sta->sta->deflink) {
>>                   mld_link_sta = &mld_sta->deflink;
>>           } else {
>>                   mld_link_sta = kzalloc(sizeof(*mld_link_sta), GFP_KERNEL);
>> -               if (!mld_link_sta)
>> +               if (!mld_link_sta) {
>> +                       IWL_ERR(mld, "mld-add-link-sta, OOM, clearing
>> fw_id_to_link_sta[%d]\n",
>> +                               fw_id);
>> +                       RCU_INIT_POINTER(mld->fw_id_to_link_sta[fw_id],
>> + NULL);
>>                           return -ENOMEM;
>> +               }
>>           }
>>
>> Thanks,
>> Ben
>>
>> --
>> Ben Greear <greearb@candelatech.com>
>> Candela Technologies Inc  http://www.candelatech.com
> 
> Please send a patch

Are you fine with having IWL_ERR in the patch like I have above?

Thanks,
Ben

> 

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com

RE: iwlwifi-mld: Fix fw id leak in OOM case

[Korenblit, Miriam Rachel]

> -----Original Message-----
> From: Ben Greear <greearb@candelatech.com>
> Sent: Tuesday, March 3, 2026 4:21 PM
> To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@intel.com>; linux-wireless
> <linux-wireless@vger.kernel.org>
> Subject: Re: iwlwifi-mld: Fix fw id leak in OOM case
> 
> On 3/2/26 23:28, Korenblit, Miriam Rachel wrote:
> >
> >
> >> -----Original Message-----
> >> From: Ben Greear <greearb@candelatech.com>
> >> Sent: Tuesday, March 3, 2026 1:07 AM
> >> To: linux-wireless <linux-wireless@vger.kernel.org>; Korenblit,
> >> Miriam Rachel <miriam.rachel.korenblit@intel.com>
> >> Subject: iwlwifi-mld: Fix fw id leak in OOM case
> >>
> >> Hello Miriam,
> >>
> >> I believe you will want to add something like this to your driver to
> >> clear the fw_id_to_link_sta ID in case you hit the ENOMEM case.
> >>
> >> I have no reason to believe I am actually hitting this error case,
> >> but I saw this questionable code while looking for reasons for the use-after-
> free I am hitting.
> >>
> >> diff --git a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
> >> b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
> >> index 5fb2a46241e4..de9939ad1d58 100644
> >> --- a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
> >> +++ b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
> >> @@ -535,13 +535,19 @@ iwl_mld_add_link_sta(struct iwl_mld *mld,
> >> struct ieee80211_link_sta *link_sta)
> >>           ret = iwl_mld_allocate_link_sta_fw_id(mld, &fw_id, link_sta);
> >>           if (ret)
> >>                   return ret;
> >>
> >>           if (link_sta == &link_sta->sta->deflink) {
> >>                   mld_link_sta = &mld_sta->deflink;
> >>           } else {
> >>                   mld_link_sta = kzalloc(sizeof(*mld_link_sta), GFP_KERNEL);
> >> -               if (!mld_link_sta)
> >> +               if (!mld_link_sta) {
> >> +                       IWL_ERR(mld, "mld-add-link-sta, OOM, clearing
> >> fw_id_to_link_sta[%d]\n",
> >> +                               fw_id);
> >> +
> >> + RCU_INIT_POINTER(mld->fw_id_to_link_sta[fw_id],
> >> + NULL);
> >>                           return -ENOMEM;
> >> +               }
> >>           }
> >>
> >> Thanks,
> >> Ben
> >>
> >> --
> >> Ben Greear <greearb@candelatech.com>
> >> Candela Technologies Inc  http://www.candelatech.com
> >
> > Please send a patch
> 
> Are you fine with having IWL_ERR in the patch like I have above?
No need for any message.
And you should have a proper commit message
> 
> Thanks,
> Ben
> 
> >
> 
> --
> Ben Greear <greearb@candelatech.com>
> Candela Technologies Inc  http://www.candelatech.com

Re: iwlwifi-mld: Fix fw id leak in OOM case

[Ben Greear]

On 3/29/26 23:55, Korenblit, Miriam Rachel wrote:

>> Are you fine with having IWL_ERR in the patch like I have above?
> No need for any message.
> And you should have a proper commit message

I already posted a real patch as part the of the big series, please pick it
out of there.

[PATCH wireless-next v2 11/28] wifi: iwlwifi: mld: Fix stale reference in fw_id_to_link_sta

Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com