* [PATCH wireless-next 01/28] wifi: iwlwifi: mld: Check for NULL before lookup.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 02/28] wifi: iwlwifi: mld: Fix un-set return value in error case greearb
` (27 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
Do not call iwl_mld_sta_from_mac80211(sta) unless we have
verified sta is non NULL.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/agg.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/agg.c b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
index 3bf36f8f6874..a757077b0a7a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/agg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
@@ -194,7 +194,7 @@ iwl_mld_reorder(struct iwl_mld *mld, struct napi_struct *napi,
struct iwl_mld_baid_data *baid_data;
struct iwl_mld_reorder_buffer *buffer;
struct iwl_mld_reorder_buf_entry *entries;
- struct iwl_mld_sta *mld_sta = iwl_mld_sta_from_mac80211(sta);
+ struct iwl_mld_sta *mld_sta;
struct iwl_mld_link_sta *mld_link_sta;
u32 reorder = le32_to_cpu(desc->reorder_data);
bool amsdu, last_subframe, is_old_sn, is_dup;
@@ -221,6 +221,8 @@ iwl_mld_reorder(struct iwl_mld *mld, struct napi_struct *napi,
"Got valid BAID without a valid station assigned\n"))
return IWL_MLD_PASS_SKB;
+ mld_sta = iwl_mld_sta_from_mac80211(sta);
+
/* not a data packet */
if (!ieee80211_is_data_qos(hdr->frame_control) ||
is_multicast_ether_addr(hdr->addr1))
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 02/28] wifi: iwlwifi: mld: Fix un-set return value in error case.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
2026-03-11 23:07 ` [PATCH wireless-next 01/28] wifi: iwlwifi: mld: Check for NULL before lookup greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 03/28] wifi: iwlwifi: mld: Add check for null vif in stats callback greearb
` (26 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
Ensure 'err' is set in error return path.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index 0c53d6bd9651..d44ec81d2ce4 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -2519,7 +2519,7 @@ iwl_mld_change_vif_links(struct ieee80211_hw *hw,
struct ieee80211_bss_conf *link_conf;
u16 removed = old_links & ~new_links;
u16 added = new_links & ~old_links;
- int err;
+ int err = -EINVAL;
lockdep_assert_wiphy(mld->wiphy);
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 03/28] wifi: iwlwifi: mld: Add check for null vif in stats callback.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
2026-03-11 23:07 ` [PATCH wireless-next 01/28] wifi: iwlwifi: mld: Check for NULL before lookup greearb
2026-03-11 23:07 ` [PATCH wireless-next 02/28] wifi: iwlwifi: mld: Fix un-set return value in error case greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 04/28] wifi: mac80211: Check debugfs creation return values greearb
` (25 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
A crash was seen in this area, protect against null.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/stats.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/stats.c b/drivers/net/wireless/intel/iwlwifi/mld/stats.c
index 7b8709716324..8d6bd7219b94 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/stats.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/stats.c
@@ -415,7 +415,7 @@ iwl_mld_process_per_link_stats(struct iwl_mld *mld,
bss_conf = wiphy_dereference(mld->wiphy,
mld->fw_id_to_bss_conf[fw_id]);
- if (!bss_conf || bss_conf->vif->type != NL80211_IFTYPE_STATION)
+ if (!bss_conf || !bss_conf->vif || bss_conf->vif->type != NL80211_IFTYPE_STATION)
continue;
link_stats = &per_link[fw_id];
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 04/28] wifi: mac80211: Check debugfs creation return values.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (2 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 03/28] wifi: iwlwifi: mld: Add check for null vif in stats callback greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 05/28] wifi: mac80211: do not fail taking sta to lower state greearb
` (24 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
Add return error checking for the debugfs directory create
calls. Assign error pointers to NULL instead of potential error
codes that the create logic may return.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
net/mac80211/debugfs.c | 11 +++++++++++
net/mac80211/debugfs_key.c | 6 ++++++
net/mac80211/debugfs_netdev.c | 33 +++++++++++++++++++++++++++++++++
net/mac80211/debugfs_sta.c | 15 +++++++++++++++
4 files changed, 65 insertions(+)
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index e8d0a8b71d59..1f428f8a7633 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -680,6 +680,12 @@ void debugfs_hw_add(struct ieee80211_local *local)
return;
local->debugfs.keys = debugfs_create_dir("keys", phyd);
+ if (IS_ERR(local->debugfs.keys)) {
+ pr_err("Failed to create local keys debugfs dir, rv: %ld phyd: 0x%px\n",
+ (long)(local->debugfs.keys), phyd);
+ local->debugfs.keys = NULL;
+ return;
+ }
DEBUGFS_ADD(total_ps_buffered);
DEBUGFS_ADD(wep_iv);
@@ -705,6 +711,11 @@ void debugfs_hw_add(struct ieee80211_local *local)
phyd, &local->aql_threshold);
statsd = debugfs_create_dir("statistics", phyd);
+ if (IS_ERR(statsd)) {
+ pr_err("Failed to create local stats debugfs dir, rv: %ld phyd: 0x%px\n",
+ (long)(statsd), phyd);
+ return;
+ }
#ifdef CONFIG_MAC80211_DEBUG_COUNTERS
DEBUGFS_STATS_ADD(dot11TransmittedFragmentCount);
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 117f58af5ff9..670bcfa8c4ed 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -335,6 +335,12 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
keycount++;
key->debugfs.dir = debugfs_create_dir(buf,
key->local->debugfs.keys);
+ if (IS_ERR(key->debugfs.dir)) {
+ pr_err("Failed to create key debugfs dir, rv: %ld phyd: 0x%px\n",
+ (long)(key->debugfs.dir), key->local->debugfs.keys);
+ key->debugfs.dir = NULL;
+ return;
+ }
sta = key->sta;
if (sta) {
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index f3c6a41e4911..51d2ae232a85 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -882,6 +882,11 @@ static void add_mesh_stats(struct ieee80211_sub_if_data *sdata)
{
struct dentry *dir = debugfs_create_dir("mesh_stats",
sdata->vif.debugfs_dir);
+ if (IS_ERR(dir)) {
+ sdata_err(sdata, "Failed to create mesh stats dir, rv: %ld vif dir: 0x%px\n",
+ (long)(dir), sdata->vif.debugfs_dir);
+ return;
+ }
#define MESHSTATS_ADD(name)\
debugfs_create_file(#name, 0400, dir, sdata, &name##_ops)
@@ -897,6 +902,11 @@ static void add_mesh_config(struct ieee80211_sub_if_data *sdata)
{
struct dentry *dir = debugfs_create_dir("mesh_config",
sdata->vif.debugfs_dir);
+ if (IS_ERR(dir)) {
+ sdata_err(sdata, "Failed to create mesh config dir, rv: %ld vif dir: 0x%px\n",
+ (long)(dir), sdata->vif.debugfs_dir);
+ return;
+ }
#define MESHPARAMS_ADD(name) \
debugfs_create_file(#name, 0600, dir, sdata, &name##_ops)
@@ -1003,10 +1013,25 @@ static void ieee80211_debugfs_add_netdev(struct ieee80211_sub_if_data *sdata,
sprintf(buf, "netdev:%s", sdata->name);
sdata->vif.debugfs_dir = debugfs_create_dir(buf,
sdata->local->hw.wiphy->debugfsdir);
+
+ if (IS_ERR(sdata->vif.debugfs_dir)) {
+ sdata_err(sdata, "Failed to create netdev dir, rv: %ld name: %s wiphy dir: 0x%px\n",
+ (long)(sdata->vif.debugfs_dir), buf, sdata->local->hw.wiphy->debugfsdir);
+ sdata->vif.debugfs_dir = NULL;
+ return;
+ }
+
/* deflink also has this */
sdata->deflink.debugfs_dir = sdata->vif.debugfs_dir;
+
sdata->debugfs.subdir_stations = debugfs_create_dir("stations",
sdata->vif.debugfs_dir);
+ if (IS_ERR(sdata->debugfs.subdir_stations)) {
+ sdata_err(sdata, "Failed to create netdev subdir-stations dir, rv: %ld wiphy dir: 0x%px\n",
+ (long)(sdata->debugfs.subdir_stations), sdata->vif.debugfs_dir);
+ sdata->debugfs.subdir_stations = NULL;
+ return;
+ }
add_files(sdata);
if (!mld_vif)
add_link_files(&sdata->deflink, sdata->vif.debugfs_dir);
@@ -1058,6 +1083,14 @@ void ieee80211_link_debugfs_add(struct ieee80211_link_data *link)
debugfs_create_dir(link_dir_name,
link->sdata->vif.debugfs_dir);
+ if (IS_ERR(link->debugfs_dir)) {
+ sdata_err(link->sdata, "Failed to create debugfs dir, rv: %ld link-dir-name: %s vif dir: 0x%px\n",
+ (long)(link->debugfs_dir), link_dir_name,
+ link->sdata->vif.debugfs_dir);
+ link->debugfs_dir = NULL;
+ return;
+ }
+
DEBUGFS_ADD(link->debugfs_dir, addr);
add_link_files(link, link->debugfs_dir);
}
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index ef75255d47d5..23cb2099e3b3 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -1250,6 +1250,12 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
* dir might still be around.
*/
sta->debugfs_dir = debugfs_create_dir(mac, stations_dir);
+ if (IS_ERR(sta->debugfs_dir)) {
+ sdata_err(sdata, "Failed to create sta debugfs dir, rv: %ld name: %s stations dir: 0x%px\n",
+ (long)(sta->debugfs_dir), mac, stations_dir);
+ sta->debugfs_dir = NULL;
+ return;
+ }
DEBUGFS_ADD(flags);
DEBUGFS_ADD(aid);
@@ -1303,6 +1309,15 @@ void ieee80211_link_sta_debugfs_add(struct link_sta_info *link_sta)
debugfs_create_dir(link_dir_name,
link_sta->sta->debugfs_dir);
+ if (IS_ERR(link_sta->debugfs_dir)) {
+ sdata_err(link_sta->sta->sdata,
+ "Failed to create link-sta debugfs dir, rv: %ld name: %s stations dir: 0x%px\n",
+ (long)(link_sta->debugfs_dir), link_dir_name,
+ link_sta->sta->debugfs_dir);
+ link_sta->debugfs_dir = NULL;
+ return;
+ }
+
DEBUGFS_ADD(addr);
} else {
if (WARN_ON(link_sta != &link_sta->sta->deflink))
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 05/28] wifi: mac80211: do not fail taking sta to lower state.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (3 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 04/28] wifi: mac80211: Check debugfs creation return values greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 06/28] wifi: mac80211: Mark sta as uploaded if single transition succeeds greearb
` (23 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
If sdata-in-driver-check fails, then we assume STA is definitely
not in the driver, and so going to less connected states should not
fail.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
net/mac80211/driver-ops.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c
index 49753b73aba2..59998d0af3ff 100644
--- a/net/mac80211/driver-ops.c
+++ b/net/mac80211/driver-ops.c
@@ -143,8 +143,12 @@ int drv_sta_state(struct ieee80211_local *local,
lockdep_assert_wiphy(local->hw.wiphy);
sdata = get_bss_sdata(sdata);
- if (!check_sdata_in_driver(sdata))
+ if (!check_sdata_in_driver(sdata)) {
+ /* Going down should not fail in this case. */
+ if (new_state < old_state)
+ return 0;
return -EIO;
+ }
trace_drv_sta_state(local, sdata, &sta->sta, old_state, new_state);
if (local->ops->sta_state) {
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 06/28] wifi: mac80211: Mark sta as uploaded if single transition succeeds.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (4 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 05/28] wifi: mac80211: do not fail taking sta to lower state greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 07/28] wifi: mac80211: Fix use-after-free of debugfs inodes greearb
` (22 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
The hope is that this would allow cleanup code to run properly in
case this fails halfway through.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
net/mac80211/sta_info.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 4259e9c13ed7..ad211c714dbb 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -836,18 +836,18 @@ static int sta_info_insert_drv_state(struct ieee80211_local *local,
err = drv_sta_state(local, sdata, sta, state, state + 1);
if (err)
break;
- }
-
- if (!err) {
/*
* Drivers using legacy sta_add/sta_remove callbacks only
* get uploaded set to true after sta_add is called.
+ * We are at least somewhat added now.
*/
if (!local->ops->sta_add)
sta->uploaded = true;
- return 0;
}
+ if (!err)
+ return 0;
+
if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
sdata_info(sdata,
"failed to move IBSS STA %pM to state %d (%d) - keeping it anyway\n",
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 07/28] wifi: mac80211: Fix use-after-free of debugfs inodes.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (5 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 06/28] wifi: mac80211: Mark sta as uploaded if single transition succeeds greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 08/28] wifi: mac80211: Debugfs safety checks greearb
` (21 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
When recursively removing debugfs files, clean up child link
debugfs pointers since the recursive removal will have deleted
their memory. This fixes use-after-free problem when those child
links are eventually cleaned up.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
net/mac80211/debugfs_netdev.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 51d2ae232a85..bc2da35db4ae 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -1039,9 +1039,28 @@ static void ieee80211_debugfs_add_netdev(struct ieee80211_sub_if_data *sdata,
void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
{
+ struct ieee80211_link_data *link;
+ int i;
+
if (!sdata->vif.debugfs_dir)
return;
+ /* In case where there were errors on station creation and maybe
+ * teardown, we may get here with some links still active. We are
+ * about to recursively delete debugfs, so remove any pointers the
+ * links may have.
+ */
+ rcu_read_lock();
+
+ for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
+ link = rcu_access_pointer(sdata->link[i]);
+ if (!link)
+ continue;
+
+ link->debugfs_dir = NULL;
+ }
+ rcu_read_unlock();
+
debugfs_remove_recursive(sdata->vif.debugfs_dir);
sdata->vif.debugfs_dir = NULL;
sdata->debugfs.subdir_stations = NULL;
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 08/28] wifi: mac80211: Debugfs safety checks.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (6 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 07/28] wifi: mac80211: Fix use-after-free of debugfs inodes greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 09/28] wifi: mac80211: Use warn-on-once in drv_remove_chanctxt greearb
` (20 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
Safety checks in case links are not be properly cleaned up at
the time we are removing netdev debugfs. Since link debugfs
is child of netdev debugfs, and we are about to recursively clean
up the netdev tree, be sure to null out any debugfs inode pointers
in the child links.
Root cause of the inode use-after-free is something
different, but this patch may also make system more resiliant.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
net/mac80211/debugfs_netdev.c | 30 ++++++++++++++++++++++++++++--
1 file changed, 28 insertions(+), 2 deletions(-)
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index bc2da35db4ae..000859b8c005 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -1037,9 +1037,33 @@ static void ieee80211_debugfs_add_netdev(struct ieee80211_sub_if_data *sdata,
add_link_files(&sdata->deflink, sdata->vif.debugfs_dir);
}
+static void
+ieee80211_debugfs_clear_link_ptr(struct ieee80211_sub_if_data *sdata,
+ struct dentry *dir)
+{
+ struct ieee80211_link_data *link;
+ int i;
+
+ rcu_read_lock();
+
+ if (sdata->vif.debugfs_dir == dir)
+ sdata->vif.debugfs_dir = NULL;
+
+ for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
+ link = rcu_access_pointer(sdata->link[i]);
+ if (!link)
+ continue;
+
+ if (dir == link->debugfs_dir)
+ link->debugfs_dir = NULL;
+ }
+ rcu_read_unlock();
+}
+
void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
{
struct ieee80211_link_data *link;
+ struct dentry *dir;
int i;
if (!sdata->vif.debugfs_dir)
@@ -1061,8 +1085,10 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
}
rcu_read_unlock();
- debugfs_remove_recursive(sdata->vif.debugfs_dir);
+ dir = sdata->vif.debugfs_dir;
+ debugfs_remove_recursive(dir);
sdata->vif.debugfs_dir = NULL;
+ ieee80211_debugfs_clear_link_ptr(sdata, dir);
sdata->debugfs.subdir_stations = NULL;
}
@@ -1151,7 +1177,7 @@ void ieee80211_link_debugfs_drv_remove(struct ieee80211_link_data *link)
/* Recreate the directory excluding the driver data */
debugfs_remove_recursive(link->debugfs_dir);
- link->debugfs_dir = NULL;
+ ieee80211_debugfs_clear_link_ptr(link->sdata, link->debugfs_dir);
ieee80211_link_debugfs_add(link);
}
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 09/28] wifi: mac80211: Use warn-on-once in drv_remove_chanctxt
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (7 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 08/28] wifi: mac80211: Debugfs safety checks greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 10/28] wifi: mac80211: Ensure sta debugfs is not double-freed greearb
` (19 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
But still log it to dmesg.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
net/mac80211/driver-ops.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 51bf3c7822a7..e2283d7dcd1e 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -1035,8 +1035,10 @@ static inline void drv_remove_chanctx(struct ieee80211_local *local,
might_sleep();
lockdep_assert_wiphy(local->hw.wiphy);
- if (WARN_ON(!ctx->driver_present))
+ if (WARN_ON_ONCE(!ctx->driver_present)) {
+ pr_err("drv-remove-chanctx, NOT driver_present, not sending request to driver.");
return;
+ }
trace_drv_remove_chanctx(local, ctx);
if (local->ops->remove_chanctx)
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 10/28] wifi: mac80211: Ensure sta debugfs is not double-freed.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (8 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 09/28] wifi: mac80211: Use warn-on-once in drv_remove_chanctxt greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 11/28] wifi: iwlwifi: mld: Fix stale reference in fw_id_to_link_sta greearb
` (18 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
I saw an instance where use-after-free was found when attempting to
delete sta's debugfs. Add check to netdev debugfs free logic to ensure
any sta's that still exist have nulled out debugfs entries since
netdev is going to do a recursive debugfs delete.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
net/mac80211/debugfs_netdev.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 000859b8c005..2e4bc34e6c5c 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -1063,6 +1063,8 @@ ieee80211_debugfs_clear_link_ptr(struct ieee80211_sub_if_data *sdata,
void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
{
struct ieee80211_link_data *link;
+ struct rhashtable_iter hti;
+ struct sta_info *sta;
struct dentry *dir;
int i;
@@ -1083,6 +1085,28 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
link->debugfs_dir = NULL;
}
+
+ /* And, same for all stations. See ieee80211_sta_debugfs_add where
+ * they are added to the sdata->debugfs.subdir_stations directory
+ */
+ rhashtable_walk_enter(&sdata->local->sta_hash.ht, &hti);
+ rhashtable_walk_start(&hti);
+
+ while ((sta = rhashtable_walk_next(&hti))) {
+ if (IS_ERR(sta)) {
+ if (PTR_ERR(sta) != -EAGAIN)
+ break;
+ continue;
+ }
+ if (sta->sdata != sdata)
+ continue;
+
+ sta->debugfs_dir = NULL;
+ }
+
+ rhashtable_walk_stop(&hti);
+ rhashtable_walk_exit(&hti);
+
rcu_read_unlock();
dir = sdata->vif.debugfs_dir;
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 11/28] wifi: iwlwifi: mld: Fix stale reference in fw_id_to_link_sta
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (9 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 10/28] wifi: mac80211: Ensure sta debugfs is not double-freed greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 12/28] wifi: iwlwifi: mld: Improve logging in error cases greearb
` (17 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
If memory cannot be allocated, clear the fw_id_to_link_sta so there
is not a dangling pointer that may later be accessed and cause
use-after-free.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/sta.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/sta.c b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
index 6b7a89e050e6..c478cee570a2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
@@ -540,8 +540,10 @@ iwl_mld_add_link_sta(struct iwl_mld *mld, struct ieee80211_link_sta *link_sta)
mld_link_sta = &mld_sta->deflink;
} else {
mld_link_sta = kzalloc_obj(*mld_link_sta);
- if (!mld_link_sta)
+ if (!mld_link_sta) {
+ RCU_INIT_POINTER(mld->fw_id_to_link_sta[fw_id], NULL);
return -ENOMEM;
+ }
}
mld_link_sta->fw_id = fw_id;
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 12/28] wifi: iwlwifi: mld: Improve logging in error cases.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (10 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 11/28] wifi: iwlwifi: mld: Fix stale reference in fw_id_to_link_sta greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 13/28] wifi: iwlwifi: mld: Remove warning about BAID greearb
` (16 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
To give better understanding of how and when failures
happen.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/sta.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/sta.c b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
index c478cee570a2..6338ca46f68e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
@@ -574,7 +574,8 @@ static int iwl_mld_rm_sta_from_fw(struct iwl_mld *mld, u8 fw_sta_id)
WIDE_ID(MAC_CONF_GROUP, STA_REMOVE_CMD),
&cmd);
if (ret)
- IWL_ERR(mld, "Failed to remove station. Id=%d\n", fw_sta_id);
+ IWL_ERR(mld, "Failed to remove station. Id=%d ret: %d\n",
+ fw_sta_id, ret);
return ret;
}
@@ -735,8 +736,10 @@ int iwl_mld_add_sta(struct iwl_mld *mld, struct ieee80211_sta *sta,
int ret;
ret = iwl_mld_init_sta(mld, sta, vif, type);
- if (ret)
+ if (ret) {
+ IWL_ERR(mld, "iwl-mld-add-sta, mld-init-sta failed. ret=%d\n", ret);
return ret;
+ }
/* We could have add only the deflink link_sta, but it will not work
* in the restart case if the single link that is active during
@@ -744,8 +747,10 @@ int iwl_mld_add_sta(struct iwl_mld *mld, struct ieee80211_sta *sta,
*/
for_each_sta_active_link(mld_sta->vif, sta, link_sta, link_id) {
ret = iwl_mld_add_link_sta(mld, link_sta);
- if (ret)
+ if (ret) {
+ IWL_ERR(mld, "iwl-mld-add-sta, mld-add-link-sta failed. ret=%d\n", ret);
goto destroy_sta;
+ }
}
return 0;
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 13/28] wifi: iwlwifi: mld: Remove warning about BAID.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (11 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 12/28] wifi: iwlwifi: mld: Improve logging in error cases greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 14/28] wifi: mac80211: Add dmesg log regarding warn-on in drv-stop greearb
` (15 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
It seems to be expected behaviour, and is seen fairly often
in testing in adverse conditions, so make it a one-line log
message instead of WARN splat.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/agg.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/agg.c b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
index a757077b0a7a..23d55374ef8a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/agg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
@@ -216,10 +216,16 @@ iwl_mld_reorder(struct iwl_mld *mld, struct napi_struct *napi,
if (baid == IWL_RX_REORDER_DATA_INVALID_BAID)
return IWL_MLD_PASS_SKB;
- /* no sta yet */
- if (WARN_ONCE(!sta,
- "Got valid BAID without a valid station assigned\n"))
+ /* no sta yet. This happens fairly often, don't WARN_ON about it. */
+ if (!sta) {
+ static bool done_once;
+
+ if (!done_once) {
+ IWL_ERR(mld, "Got valid BAID without a valid station assigned, will not log again.\n");
+ done_once = true;
+ }
return IWL_MLD_PASS_SKB;
+ }
mld_sta = iwl_mld_sta_from_mac80211(sta);
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 14/28] wifi: mac80211: Add dmesg log regarding warn-on in drv-stop.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (12 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 13/28] wifi: iwlwifi: mld: Remove warning about BAID greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 15/28] wifi: iwlwifi: mld: Fix use-after-free of bss_conf greearb
` (14 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
And make it WARN_ON_ONCE.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
net/mac80211/driver-ops.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c
index 59998d0af3ff..397a0281412a 100644
--- a/net/mac80211/driver-ops.c
+++ b/net/mac80211/driver-ops.c
@@ -38,8 +38,10 @@ void drv_stop(struct ieee80211_local *local, bool suspend)
might_sleep();
lockdep_assert_wiphy(local->hw.wiphy);
- if (WARN_ON(!local->started))
+ if (WARN_ON_ONCE(!local->started)) {
+ pr_err("mac80211: drv-stop called but local is not started.\n");
return;
+ }
trace_drv_stop(local, suspend);
local->ops->stop(&local->hw, suspend);
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 15/28] wifi: iwlwifi: mld: Fix use-after-free of bss_conf
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (13 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 14/28] wifi: mac80211: Add dmesg log regarding warn-on in drv-stop greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 16/28] wifi: iwlwifi: mld: Check for null in iwl_mld_wait_sta_txqs_empty greearb
` (13 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
In certain failure paths, the driver is not fully configured, and
it fails to find the link object. We still need to remove pointers
to the bss_conf to keep from crashing shortly afterwards.
Search all indices for stale pointer if we cannot do the fast
lookup by ID.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/link.c | 42 +++++++++++++++----
1 file changed, 34 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/link.c b/drivers/net/wireless/intel/iwlwifi/mld/link.c
index b5430e8a73d6..1e4959ceb3db 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/link.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/link.c
@@ -504,23 +504,49 @@ void iwl_mld_remove_link(struct iwl_mld *mld,
struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(bss_conf->vif);
struct iwl_mld_link *link = iwl_mld_link_from_mac80211(bss_conf);
bool is_deflink = link == &mld_vif->deflink;
- u8 fw_id = link->fw_id;
+ u16 fw_id;
- if (WARN_ON(!link || link->active))
- return;
+ if (WARN_ON_ONCE(!link)) {
+ IWL_ERR(mld, "Remove nonexistent link, bss_conf: 0x%px link-id: %d\n",
+ bss_conf, bss_conf->link_id);
+ fw_id = 0xffff;
+ } else {
+ fw_id = link->fw_id;
+ }
+
+ /* Not cleaning it up seems worse than cleaning up an active link,
+ * so continue on even in warning case.
+ */
+ if (link && WARN_ON_ONCE(link->active))
+ IWL_ERR(mld, "Removing active link, id: %d\n",
+ bss_conf->link_id);
iwl_mld_rm_link_from_fw(mld, bss_conf);
/* Continue cleanup on failure */
- if (!is_deflink)
+ if (link && !is_deflink)
kfree_rcu(link, rcu_head);
+ rcu_read_lock();
RCU_INIT_POINTER(mld_vif->link[bss_conf->link_id], NULL);
- if (WARN_ON(fw_id >= mld->fw->ucode_capa.num_links))
- return;
-
- RCU_INIT_POINTER(mld->fw_id_to_bss_conf[fw_id], NULL);
+ if (fw_id >= mld->fw->ucode_capa.num_links) {
+ struct ieee80211_bss_conf *tmp_bss_conf;
+ int i;
+
+ /* Search for any existing back-pointer */
+ for (i = 0; i < ARRAY_SIZE(mld->fw_id_to_bss_conf); i++) {
+ tmp_bss_conf = rcu_dereference(mld->fw_id_to_bss_conf[i]);
+ if (tmp_bss_conf == bss_conf) {
+ IWL_ERR(mld, "WARNING: Found bss_conf in fw_id_to_bss_conf[%i], Nulling pointer.\n",
+ i);
+ RCU_INIT_POINTER(mld->fw_id_to_bss_conf[i], NULL);
+ }
+ }
+ } else {
+ RCU_INIT_POINTER(mld->fw_id_to_bss_conf[fw_id], NULL);
+ }
+ rcu_read_unlock();
}
void iwl_mld_handle_missed_beacon_notif(struct iwl_mld *mld,
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 16/28] wifi: iwlwifi: mld: Check for null in iwl_mld_wait_sta_txqs_empty
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (14 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 15/28] wifi: iwlwifi: mld: Fix use-after-free of bss_conf greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 17/28] wifi: iwlwifi: mld: use warn-on-once in error path greearb
` (12 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
I saw some crashes here in eMLSR torture test, looks like mld_txq
was NULL, so add check.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/sta.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/sta.c b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
index 6338ca46f68e..288fc4b7604e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
@@ -789,7 +789,7 @@ void iwl_mld_wait_sta_txqs_empty(struct iwl_mld *mld, struct ieee80211_sta *sta)
struct iwl_mld_txq *mld_txq =
iwl_mld_txq_from_mac80211(sta->txq[i]);
- if (!mld_txq->status.allocated)
+ if (!mld_txq || !mld_txq->status.allocated)
continue;
iwl_trans_wait_txq_empty(mld->trans, mld_txq->fw_id);
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 17/28] wifi: iwlwifi: mld: use warn-on-once in error path.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (15 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 16/28] wifi: iwlwifi: mld: Check for null in iwl_mld_wait_sta_txqs_empty greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 18/28] wifi: iwlwifi: mld: Use warn-on-once in emlsr exit logic greearb
` (11 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
Just splat a WARNING once, and add debug output to indicate
a bit about why it is hitting the warn path.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/agg.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/agg.c b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
index 23d55374ef8a..413a8688e4eb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/agg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
@@ -496,7 +496,9 @@ static void iwl_mld_free_reorder_buffer(struct iwl_mld *mld,
* sync internal DELBA notification should trigger a release
* of all frames in the reorder buffer.
*/
- WARN_ON(1);
+ WARN_ON_ONCE(1);
+ IWL_ERR(mld, "free-reorder-buffer problem, rxq: %d num-stored: %d, will purge frames\n",
+ i, reorder_buf->num_stored);
for (int j = 0; j < data->buf_size; j++)
__skb_queue_purge(&entries[j].frames);
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 18/28] wifi: iwlwifi: mld: Use warn-on-once in emlsr exit logic.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (16 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 17/28] wifi: iwlwifi: mld: use warn-on-once in error path greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 19/28] wifi: iwlwifi: mld: Improve error message in rx path greearb
` (10 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
Only splat warning once, and improve logging to indicate more
about why it is in the problem state.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
index f842f5183223..7a37ca64a612 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
@@ -164,7 +164,10 @@ static void iwl_mld_check_emlsr_prevention(struct iwl_mld *mld,
* The timeouts are chosen so that this will not happen, i.e.
* IWL_MLD_EMLSR_PREVENT_LONG > IWL_MLD_PREVENT_EMLSR_TIMEOUT
*/
- WARN_ON(mld_vif->emlsr.exit_repeat_count > 3);
+ if (WARN_ON_ONCE(mld_vif->emlsr.exit_repeat_count > 3)) {
+ IWL_ERR(mld, "check-emlsr-prevention exit repeats: %d > 3, blocked-reasons: 0x%x\n",
+ mld_vif->emlsr.exit_repeat_count, mld_vif->emlsr.blocked_reasons);
+ }
}
IWL_DEBUG_EHT(mld,
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 19/28] wifi: iwlwifi: mld: Improve error message in rx path.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (17 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 18/28] wifi: iwlwifi: mld: Use warn-on-once in emlsr exit logic greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 20/28] wifi: iwlwifi: mld: Improve logging message greearb
` (9 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
Print return code that is causing the failure path.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/rx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/rx.c b/drivers/net/wireless/intel/iwlwifi/mld/rx.c
index 214dcfde2fb4..f5c20a3aa869 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/rx.c
@@ -2204,8 +2204,8 @@ void iwl_mld_sync_rx_queues(struct iwl_mld *mld,
ret = wait_event_timeout(mld->rxq_sync.waitq,
READ_ONCE(mld->rxq_sync.state) == 0,
SYNC_RX_QUEUE_TIMEOUT);
- WARN_ONCE(!ret, "RXQ sync failed: state=0x%lx, cookie=%d\n",
- mld->rxq_sync.state, mld->rxq_sync.cookie);
+ WARN_ONCE(!ret, "RXQ sync failed: state=0x%lx, cookie=%d, ret: %d\n",
+ mld->rxq_sync.state, mld->rxq_sync.cookie, ret);
out:
mld->rxq_sync.state = 0;
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 20/28] wifi: iwlwifi: mld: Improve logging message.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (18 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 19/28] wifi: iwlwifi: mld: Improve error message in rx path greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 21/28] wifi: iwlwifi: mld: Protect from null mld_sta greearb
` (8 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
Indicate that the problem is being fixed.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index d44ec81d2ce4..aa4d391ffc00 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -647,7 +647,7 @@ void iwl_mld_mac80211_stop(struct ieee80211_hw *hw, bool suspend)
*/
for (int i = 0; i < ARRAY_SIZE(mld->scan.uid_status); i++)
if (WARN_ONCE(mld->scan.uid_status[i],
- "UMAC scan UID %d status was not cleaned (0x%x 0x%x)\n",
+ "mac80211-stop: UMAC scan UID %d status was not cleaned (0x%x 0x%x), forcing to 0\n",
i, mld->scan.uid_status[i], mld->scan.status))
mld->scan.uid_status[i] = 0;
}
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 21/28] wifi: iwlwifi: mld: Protect from null mld_sta
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (19 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 20/28] wifi: iwlwifi: mld: Improve logging message greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 22/28] wifi: mac80211: Add force-cleanup call to driver greearb
` (7 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
Torture tests were crashing here, protect against a null
mld_sta.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index aa4d391ffc00..badaceb120b3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -1911,6 +1911,7 @@ static void iwl_mld_mac80211_flush(struct ieee80211_hw *hw,
iwl_mld_add_txq_list(mld);
for (int i = 0; i < mld->fw->ucode_capa.num_stations; i++) {
+ struct iwl_mld_sta *mld_sta;
struct ieee80211_link_sta *link_sta =
wiphy_dereference(mld->wiphy,
mld->fw_id_to_link_sta[i]);
@@ -1919,7 +1920,8 @@ static void iwl_mld_mac80211_flush(struct ieee80211_hw *hw,
continue;
/* Check that the sta belongs to the given vif */
- if (vif && vif != iwl_mld_sta_from_mac80211(link_sta->sta)->vif)
+ mld_sta = iwl_mld_sta_from_mac80211(link_sta->sta);
+ if (vif && (!mld_sta || vif != mld_sta->vif))
continue;
if (drop)
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 22/28] wifi: mac80211: Add force-cleanup call to driver.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (20 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 21/28] wifi: iwlwifi: mld: Protect from null mld_sta greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 23/28] wifi: iwlwifi: mld: Support force-cleanup op greearb
` (6 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
When hardware is determined by mac80211 to be in non-recoverable
state, then SDATA_IN_DRIVER flag is removed, and mac80211 will no
longer do any 'graceful' teardown of the objects in the driver.
This was causing use-after-free crashes in the iwlwifi driver
since it's logic to do internal cleanup is not quite right for
some reason.
Add an explicit callback to the driver to tell it to clean up
whatever it needs to clean up in case mac80211 considers it
dead.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
include/net/mac80211.h | 7 +++++++
net/mac80211/driver-ops.h | 8 ++++++++
net/mac80211/util.c | 5 +++++
3 files changed, 20 insertions(+)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 9cc482191ab9..d963f213863b 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -3934,6 +3934,12 @@ struct ieee80211_prep_tx_info {
* you should ensure to cancel it on this callback.
* Must be implemented and can sleep.
*
+ * @force_cleanup: Called after mac80211 determines the
+ * driver/firmware/hardware has failed and cannot
+ * be restarted. SDATA_IN_DRIVER is false at this point,
+ * so normal cleanup will not happen. This force_cleanup
+ * operation lets the driver do any needed houskeeping.
+ *
* @suspend: Suspend the device; mac80211 itself will quiesce before and
* stop transmitting and doing any other configuration, and then
* ask the device to suspend. This is only invoked when WoWLAN is
@@ -4569,6 +4575,7 @@ struct ieee80211_ops {
struct sk_buff *skb);
int (*start)(struct ieee80211_hw *hw);
void (*stop)(struct ieee80211_hw *hw, bool suspend);
+ void (*force_cleanup)(struct ieee80211_hw *hw);
#ifdef CONFIG_PM
int (*suspend)(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan);
int (*resume)(struct ieee80211_hw *hw);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index e2283d7dcd1e..3bd3d078ce9b 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -300,6 +300,14 @@ static inline void drv_cancel_hw_scan(struct ieee80211_local *local,
trace_drv_return_void(local);
}
+static inline void
+drv_force_cleanup(struct ieee80211_local *local)
+{
+ lockdep_assert_wiphy(local->hw.wiphy);
+ if (local->ops->force_cleanup)
+ local->ops->force_cleanup(&local->hw);
+}
+
static inline int
drv_sched_scan_start(struct ieee80211_local *local,
struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 55054de62508..ec11ee6b8752 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1692,6 +1692,11 @@ static void ieee80211_handle_reconfig_failure(struct ieee80211_local *local)
*/
list_for_each_entry(ctx, &local->chanctx_list, list)
ctx->driver_present = false;
+
+ /* Tell driver to purge any remaining configuration it may have
+ * lingering around.
+ */
+ drv_force_cleanup(local);
}
static void ieee80211_assign_chanctx(struct ieee80211_local *local,
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 23/28] wifi: iwlwifi: mld: Support force-cleanup op
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (21 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 22/28] wifi: mac80211: Add force-cleanup call to driver greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 24/28] wifi: iwlwifi: mld: Fix NPE in flush logic greearb
` (5 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
This lets mac80211 force the driver to clean up any lingering
configuration, fixing use-after-free in case of unrecoverable
hardware failure.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index badaceb120b3..03810291ed33 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -560,6 +560,18 @@ iwl_mld_restart_cleanup(struct iwl_mld *mld)
iwl_mld_ftm_restart_cleanup(mld);
}
+/* mac80211 thinks our driver/firmware/hardware has crashed
+ * and cannot be recovered. Force clean any existing configuration
+ * (stas, etc), as mac80211 will not attempt further cleanup.
+ */
+static void iwl_mld_mac80211_force_cleanup(struct ieee80211_hw *hw)
+{
+ struct iwl_mld *mld = IWL_MAC80211_GET_MLD(hw);
+
+ IWL_ERR(mld, "mac80211-force-cleanup called, calling mld_restart_cleanup.\n");
+ iwl_mld_restart_cleanup(mld);
+}
+
static
int iwl_mld_mac80211_start(struct ieee80211_hw *hw)
{
@@ -2717,6 +2729,7 @@ const struct ieee80211_ops iwl_mld_hw_ops = {
.config = iwl_mld_mac80211_config,
.get_antenna = iwl_mld_get_antenna,
.set_antenna = iwl_mld_set_antenna,
+ .force_cleanup = iwl_mld_mac80211_force_cleanup,
.add_interface = iwl_mld_mac80211_add_interface,
.remove_interface = iwl_mld_mac80211_remove_interface,
.conf_tx = iwl_mld_mac80211_conf_tx,
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 24/28] wifi: iwlwifi: mld: Fix NPE in flush logic.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (22 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 23/28] wifi: iwlwifi: mld: Support force-cleanup op greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 25/28] wifi: iwlwifi: mld: Fix bad return address in tx code greearb
` (4 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
It appears that sometimes the sta can be NULL, so check for
that and return early.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/sta.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/sta.c b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
index 288fc4b7604e..06e064466e3b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/sta.c
@@ -779,6 +779,9 @@ void iwl_mld_flush_sta_txqs(struct iwl_mld *mld, struct ieee80211_sta *sta)
void iwl_mld_wait_sta_txqs_empty(struct iwl_mld *mld, struct ieee80211_sta *sta)
{
+ if (!sta)
+ return;
+
/* Avoid a warning in iwl_trans_wait_txq_empty if are anyway on the way
* to a restart.
*/
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 25/28] wifi: iwlwifi: mld: Fix bad return address in tx code.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (23 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 24/28] wifi: iwlwifi: mld: Fix NPE in flush logic greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 26/28] wifi: mac80211: Ensure link work-items are only initialized once greearb
` (3 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
iwl_mld_txq_from_mac80211 was returning the offset into
txq without checking if txq was NULL. In case txq is
NULL, this would return a small, but non NULL pointer.
The safety check in calling code would then treat it
as non-null and attempt to dereference.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/tx.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.h b/drivers/net/wireless/intel/iwlwifi/mld/tx.h
index 520f15f9d33c..8b0da098c25f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/tx.h
+++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.h
@@ -45,6 +45,8 @@ static inline void iwl_mld_init_txq(struct iwl_mld_txq *mld_txq)
static inline struct iwl_mld_txq *
iwl_mld_txq_from_mac80211(struct ieee80211_txq *txq)
{
+ if (!txq)
+ return NULL;
return (void *)txq->drv_priv;
}
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 26/28] wifi: mac80211: Ensure link work-items are only initialized once.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (24 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 25/28] wifi: iwlwifi: mld: Fix bad return address in tx code greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 27/28] wifi: iwlwifi: mld: Convert to WARN_ONCE in link removal path greearb
` (2 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
Re-initialization could cause corruption in work queues in case
links were not properly stopped for some reason.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
net/mac80211/ieee80211_i.h | 1 +
net/mac80211/link.c | 28 ++++++++++++++++++++--------
2 files changed, 21 insertions(+), 8 deletions(-)
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index d71e0c6d2165..ac4e10f16cd9 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1079,6 +1079,7 @@ struct ieee80211_link_data {
bool operating_11g_mode;
+ bool already_initialized; /* has ieee80211_link_init been called? */
struct {
struct wiphy_work finalize_work;
diff --git a/net/mac80211/link.c b/net/mac80211/link.c
index 03bfca27d205..6125e79f67c9 100644
--- a/net/mac80211/link.c
+++ b/net/mac80211/link.c
@@ -110,14 +110,25 @@ void ieee80211_link_init(struct ieee80211_sub_if_data *sdata,
link->user_power_level = sdata->local->user_power_level;
link_conf->txpower = INT_MIN;
- wiphy_work_init(&link->csa.finalize_work,
- ieee80211_csa_finalize_work);
- wiphy_work_init(&link->color_change_finalize_work,
- ieee80211_color_change_finalize_work);
- wiphy_delayed_work_init(&link->color_collision_detect_work,
- ieee80211_color_collision_detection_work);
- wiphy_hrtimer_work_init(&link->dfs_cac_timer_work,
- ieee80211_dfs_cac_timer_work);
+ if (link->already_initialized) {
+ wiphy_delayed_work_cancel(link->sdata->local->hw.wiphy,
+ &link->color_collision_detect_work);
+ wiphy_work_cancel(link->sdata->local->hw.wiphy,
+ &link->color_change_finalize_work);
+ wiphy_work_cancel(link->sdata->local->hw.wiphy,
+ &link->csa.finalize_work);
+ wiphy_hrtimer_work_cancel(link->sdata->local->hw.wiphy,
+ &link->dfs_cac_timer_work);
+ } else {
+ wiphy_work_init(&link->csa.finalize_work,
+ ieee80211_csa_finalize_work);
+ wiphy_work_init(&link->color_change_finalize_work,
+ ieee80211_color_change_finalize_work);
+ wiphy_delayed_work_init(&link->color_collision_detect_work,
+ ieee80211_color_collision_detection_work);
+ wiphy_hrtimer_work_init(&link->dfs_cac_timer_work,
+ ieee80211_dfs_cac_timer_work);
+ }
if (!deflink) {
switch (sdata->vif.type) {
@@ -138,6 +149,7 @@ void ieee80211_link_init(struct ieee80211_sub_if_data *sdata,
ieee80211_link_debugfs_add(link);
}
+ link->already_initialized = true;
rcu_assign_pointer(sdata->vif.link_conf[link_id], link_conf);
rcu_assign_pointer(sdata->link[link_id], link);
}
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 27/28] wifi: iwlwifi: mld: Convert to WARN_ONCE in link removal path.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (25 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 26/28] wifi: mac80211: Ensure link work-items are only initialized once greearb
@ 2026-03-11 23:07 ` greearb
2026-03-11 23:07 ` [PATCH wireless-next 28/28] wifi: mac80211: Decrease WARN spam greearb
2026-03-12 14:25 ` [syzbot ci] Re: iwlwifi + mac80211 stability syzbot ci
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
While the comment indicates this should not happen, it does at least
when firmware is being problematic. Change to WARN_ON_ONCE to
decrease log spam.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
drivers/net/wireless/intel/iwlwifi/mld/sta.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/sta.h b/drivers/net/wireless/intel/iwlwifi/mld/sta.h
index 1897b121aae2..44c54e6d68e6 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mld/sta.h
@@ -170,7 +170,7 @@ iwl_mld_cleanup_sta(void *data, struct ieee80211_sta *sta)
continue;
/* Should not happen as link removal should always succeed */
- WARN_ON(1);
+ WARN_ON_ONCE(1);
RCU_INIT_POINTER(mld_sta->link[link_id], NULL);
RCU_INIT_POINTER(mld_sta->mld->fw_id_to_link_sta[mld_link_sta->fw_id],
NULL);
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [PATCH wireless-next 28/28] wifi: mac80211: Decrease WARN spam.
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (26 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 27/28] wifi: iwlwifi: mld: Convert to WARN_ONCE in link removal path greearb
@ 2026-03-11 23:07 ` greearb
2026-03-12 14:25 ` [syzbot ci] Re: iwlwifi + mac80211 stability syzbot ci
28 siblings, 0 replies; 32+ messages in thread
From: greearb @ 2026-03-11 23:07 UTC (permalink / raw)
To: linux-wireless; +Cc: Ben Greear
From: Ben Greear <greearb@candelatech.com>
Comment one of them out, and make another WARN_ONCE.
Signed-off-by: Ben Greear <greearb@candelatech.com>
---
net/mac80211/link.c | 1 -
net/mac80211/util.c | 3 ++-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/mac80211/link.c b/net/mac80211/link.c
index 6125e79f67c9..e3a825ea3a04 100644
--- a/net/mac80211/link.c
+++ b/net/mac80211/link.c
@@ -544,7 +544,6 @@ static int _ieee80211_set_active_links(struct ieee80211_sub_if_data *sdata,
ret = drv_change_sta_links(local, sdata, &sta->sta,
old_active | active_links,
active_links);
- WARN_ON_ONCE(ret);
/*
* Do it again, just in case - the driver might very
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index ec11ee6b8752..df156f8b5211 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1879,7 +1879,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
if (suspended)
WARN(1, "Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n");
else
- WARN(1, "Hardware became unavailable during restart.\n");
+ WARN_ONCE(1, "Hardware became unavailable during restart: %d\n", res);
+
ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
IEEE80211_QUEUE_STOP_REASON_SUSPEND,
false);
--
2.42.0
^ permalink raw reply related [flat|nested] 32+ messages in thread* [syzbot ci] Re: iwlwifi + mac80211 stability
2026-03-11 23:07 [PATCH wireless-next 00/28] iwlwifi + mac80211 stability greearb
` (27 preceding siblings ...)
2026-03-11 23:07 ` [PATCH wireless-next 28/28] wifi: mac80211: Decrease WARN spam greearb
@ 2026-03-12 14:25 ` syzbot ci
2026-03-12 15:25 ` Ben Greear
28 siblings, 1 reply; 32+ messages in thread
From: syzbot ci @ 2026-03-12 14:25 UTC (permalink / raw)
To: greearb, linux-wireless; +Cc: syzbot, syzkaller-bugs
syzbot ci has tested the following series
[v1] iwlwifi + mac80211 stability
https://lore.kernel.org/all/20260311230730.163348-1-greearb@candelatech.com
* [PATCH wireless-next 01/28] wifi: iwlwifi: mld: Check for NULL before lookup.
* [PATCH wireless-next 02/28] wifi: iwlwifi: mld: Fix un-set return value in error case.
* [PATCH wireless-next 03/28] wifi: iwlwifi: mld: Add check for null vif in stats callback.
* [PATCH wireless-next 04/28] wifi: mac80211: Check debugfs creation return values.
* [PATCH wireless-next 05/28] wifi: mac80211: do not fail taking sta to lower state.
* [PATCH wireless-next 06/28] wifi: mac80211: Mark sta as uploaded if single transition succeeds.
* [PATCH wireless-next 07/28] wifi: mac80211: Fix use-after-free of debugfs inodes.
* [PATCH wireless-next 08/28] wifi: mac80211: Debugfs safety checks.
* [PATCH wireless-next 09/28] wifi: mac80211: Use warn-on-once in drv_remove_chanctxt
* [PATCH wireless-next 10/28] wifi: mac80211: Ensure sta debugfs is not double-freed.
* [PATCH wireless-next 11/28] wifi: iwlwifi: mld: Fix stale reference in fw_id_to_link_sta
* [PATCH wireless-next 12/28] wifi: iwlwifi: mld: Improve logging in error cases.
* [PATCH wireless-next 13/28] wifi: iwlwifi: mld: Remove warning about BAID.
* [PATCH wireless-next 14/28] wifi: mac80211: Add dmesg log regarding warn-on in drv-stop.
* [PATCH wireless-next 15/28] wifi: iwlwifi: mld: Fix use-after-free of bss_conf
* [PATCH wireless-next 16/28] wifi: iwlwifi: mld: Check for null in iwl_mld_wait_sta_txqs_empty
* [PATCH wireless-next 17/28] wifi: iwlwifi: mld: use warn-on-once in error path.
* [PATCH wireless-next 18/28] wifi: iwlwifi: mld: Use warn-on-once in emlsr exit logic.
* [PATCH wireless-next 19/28] wifi: iwlwifi: mld: Improve error message in rx path.
* [PATCH wireless-next 20/28] wifi: iwlwifi: mld: Improve logging message.
* [PATCH wireless-next 21/28] wifi: iwlwifi: mld: Protect from null mld_sta
* [PATCH wireless-next 22/28] wifi: mac80211: Add force-cleanup call to driver.
* [PATCH wireless-next 23/28] wifi: iwlwifi: mld: Support force-cleanup op
* [PATCH wireless-next 24/28] wifi: iwlwifi: mld: Fix NPE in flush logic.
* [PATCH wireless-next 25/28] wifi: iwlwifi: mld: Fix bad return address in tx code.
* [PATCH wireless-next 26/28] wifi: mac80211: Ensure link work-items are only initialized once.
* [PATCH wireless-next 27/28] wifi: iwlwifi: mld: Convert to WARN_ONCE in link removal path.
* [PATCH wireless-next 28/28] wifi: mac80211: Decrease WARN spam.
and found the following issue:
WARNING in drv_add_interface
Full report is available here:
https://ci.syzbot.org/series/d3986751-1907-410b-b80c-976f38583b8c
***
WARNING in drv_add_interface
tree: linux-next
URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/next/linux-next
base: 97492c019da4b62df83255e968b23b81c0315530
arch: amd64
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
config: https://ci.syzbot.org/builds/acf234a5-5041-402a-ace9-5766b71cadb4/config
C repro: https://ci.syzbot.org/findings/1533841d-c00d-4811-84c1-419f7bccc86a/c_repro
syz repro: https://ci.syzbot.org/findings/1533841d-c00d-4811-84c1-419f7bccc86a/syz_repro
------------[ cut here ]------------
!sdata->vif.debugfs_dir
WARNING: net/mac80211/driver-ops.h:510 at drv_vif_add_debugfs net/mac80211/driver-ops.h:510 [inline], CPU#1: dhcpcd/5553
WARNING: net/mac80211/driver-ops.h:510 at drv_add_interface+0x5e5/0x910 net/mac80211/driver-ops.c:84, CPU#1: dhcpcd/5553
Modules linked in:
CPU: 1 UID: 0 PID: 5553 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:drv_vif_add_debugfs net/mac80211/driver-ops.h:510 [inline]
RIP: 0010:drv_add_interface+0x5e5/0x910 net/mac80211/driver-ops.c:84
Code: f3 fa ff ff e8 9c 22 ae f6 48 8d 3d 85 f2 0a 05 67 48 0f b9 3a e9 c1 fc ff ff e8 86 22 ae f6 e9 19 fb ff ff e8 7c 22 ae f6 90 <0f> 0b 90 eb 94 e8 71 22 ae f6 4c 8d 35 7a f2 0a 05 49 8d bf 28 0a
RSP: 0018:ffffc90003b57678 EFLAGS: 00010293
RAX: ffffffff8b1776f4 RBX: ffff888172594dc0 RCX: ffff8881165657c0
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000006
RBP: 0000000000000000 R08: ffffffff901146b7 R09: 1ffffffff20228d6
R10: dffffc0000000000 R11: fffffbfff20228d7 R12: dffffc0000000000
R13: ffff888172597028 R14: ffff8881725957f8 R15: 0000000000000002
FS: 00007ff45a6f6740(0000) GS:ffff8882a9465000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055d00b0c3161 CR3: 000000010017c000 CR4: 00000000000006f0
Call Trace:
<TASK>
ieee80211_do_open+0x929/0x2490 net/mac80211/iface.c:1466
ieee80211_open+0x15b/0x200 net/mac80211/iface.c:472
__dev_open+0x44d/0x830 net/core/dev.c:1702
__dev_change_flags+0x1f7/0x690 net/core/dev.c:9778
netif_change_flags+0x88/0x1a0 net/core/dev.c:9841
dev_change_flags+0x130/0x260 net/core/dev_api.c:68
devinet_ioctl+0x9f2/0x1b30 net/ipv4/devinet.c:1199
inet_ioctl+0x42a/0x560 net/ipv4/af_inet.c:1004
sock_do_ioctl+0x101/0x320 net/socket.c:1253
sock_ioctl+0x5c6/0x7f0 net/socket.c:1374
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff45a7c4d49
Code: 5c c3 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 76 10 48 8b 15 ae 60 0d 00 f7 d8 41 83 c8
RSP: 002b:00007ffff8603cd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ff45a6f66c0 RCX: 00007ff45a7c4d49
RDX: 00007ffff8613ec8 RSI: 0000000000008914 RDI: 0000000000000011
RBP: 00007ffff8624088 R08: 00007ffff8613e88 R09: 00007ffff8613e38
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffff8613ec8 R14: 0000000000000028 R15: 0000000000008914
</TASK>
***
If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
Tested-by: syzbot@syzkaller.appspotmail.com
---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [syzbot ci] Re: iwlwifi + mac80211 stability
2026-03-12 14:25 ` [syzbot ci] Re: iwlwifi + mac80211 stability syzbot ci
@ 2026-03-12 15:25 ` Ben Greear
2026-03-12 17:44 ` Johannes Berg
0 siblings, 1 reply; 32+ messages in thread
From: Ben Greear @ 2026-03-12 15:25 UTC (permalink / raw)
To: syzbot ci, linux-wireless; +Cc: syzbot, syzkaller-bugs
On 3/12/26 07:25, syzbot ci wrote:
> syzbot ci has tested the following series
Thank you syzbot.
The logs show this:
[ 74.595871][ T64] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 74.604375][ T64] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 74.621865][ T1095] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 74.624268][ T1095] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 74.667157][ T5962] Failed to create local keys debugfs dir, rv: -13 phyd: 0xfffffffffffffff3
[ 74.673187][ T5962] wlan2: Failed to create netdev dir, rv: -13 name: netdev:wlan2 wiphy dir: 0xfffffffffffffff3
[ 74.885583][ T5553] ------------[ cut here ]------------
Which would be triggered by this from patch 0004, I guess. The phyd
pointer appears to be an error code -13 instead of clean NULL, so I guess I
need to add checks for where that is created as well.
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -680,6 +680,12 @@ void debugfs_hw_add(struct ieee80211_local *local)
return;
local->debugfs.keys = debugfs_create_dir("keys", phyd);
+ if (IS_ERR(local->debugfs.keys)) {
+ pr_err("Failed to create local keys debugfs dir, rv: %ld phyd: 0x%px\n",
+ (long)(local->debugfs.keys), phyd);
+ local->debugfs.keys = NULL;
+ return;
+ }
Thanks,
Ben
--
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc http://www.candelatech.com
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [syzbot ci] Re: iwlwifi + mac80211 stability
2026-03-12 15:25 ` Ben Greear
@ 2026-03-12 17:44 ` Johannes Berg
0 siblings, 0 replies; 32+ messages in thread
From: Johannes Berg @ 2026-03-12 17:44 UTC (permalink / raw)
To: Ben Greear, syzbot ci, linux-wireless; +Cc: syzbot, syzkaller-bugs
On Thu, 2026-03-12 at 08:25 -0700, Ben Greear wrote:
> Which would be triggered by this from patch 0004, I guess. The phyd
> pointer appears to be an error code -13 instead of clean NULL, so I guess I
> need to add checks for where that is created as well.
No ...
> --- a/net/mac80211/debugfs.c
> +++ b/net/mac80211/debugfs.c
> @@ -680,6 +680,12 @@ void debugfs_hw_add(struct ieee80211_local *local)
> return;
>
> local->debugfs.keys = debugfs_create_dir("keys", phyd);
> + if (IS_ERR(local->debugfs.keys)) {
> + pr_err("Failed to create local keys debugfs dir, rv: %ld phyd: 0x%px\n",
> + (long)(local->debugfs.keys), phyd);
> + local->debugfs.keys = NULL;
> + return;
> + }
That's just never going to get applied anyway, so what you _really_ need
to do is stop sending this crap.
johannes
^ permalink raw reply [flat|nested] 32+ messages in thread