[PATCH RESEND wireless-next 0/9] wifi: further RTNL redux

[PATCH RESEND wireless-next 0/9] wifi: further RTNL redux

[Johannes Berg]

Somehow NIPA didn't manage to apply the previous round, likely
because I sent it too quickly after pushing, it was here:

https://lore.kernel.org/linux-wireless/20261009145703.243031-11-johannes@sipsolutions.net/

So this is just a resend, since I'd probably ask anyone else to
do that too if NIPA didn't run :)

johannes

[PATCH RESEND wireless-next 1/9] wifi: nl80211: avoid RTNL in nl80211_get_reg_do()

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

We don't need the RTNL here now, all the work can happen
under RCU. Drop the RTNL and do it all under RCU instead.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/wireless/nl80211.c | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index a48bd4e4f4c7..b5b9d8830af5 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -10841,7 +10841,7 @@ static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
 	if (!hdr)
 		goto put_failure;
 
-	rtnl_lock();
+	rcu_read_lock();
 
 	if (info->attrs[NL80211_ATTR_WIPHY]) {
 		bool self_managed;
@@ -10856,44 +10856,37 @@ static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
 		self_managed = wiphy->regulatory_flags &
 			       REGULATORY_WIPHY_SELF_MANAGED;
 
-		rcu_read_lock();
-
 		regdom = get_wiphy_regdom(wiphy);
 
 		/* a self-managed-reg device must have a private regdom */
 		if (WARN_ON(!regdom && self_managed)) {
 			err = -EINVAL;
-			goto nla_put_failure_rcu;
+			goto nla_put_failure;
 		}
 
 		if (regdom &&
 		    nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
-			goto nla_put_failure_rcu;
-	} else {
-		rcu_read_lock();
+			goto nla_put_failure;
 	}
 
 	if (!wiphy && reg_last_request_cell_base() &&
 	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
 			NL80211_USER_REG_HINT_CELL_BASE))
-		goto nla_put_failure_rcu;
+		goto nla_put_failure;
 
 	if (!regdom)
 		regdom = rcu_dereference(cfg80211_regdomain);
 
 	if (nl80211_put_regdom(regdom, msg))
-		goto nla_put_failure_rcu;
+		goto nla_put_failure;
 
 	rcu_read_unlock();
 
 	genlmsg_end(msg, hdr);
-	rtnl_unlock();
 	return genlmsg_reply(msg, info);
 
-nla_put_failure_rcu:
-	rcu_read_unlock();
 nla_put_failure:
-	rtnl_unlock();
+	rcu_read_unlock();
 put_failure:
 	nlmsg_free(msg);
 	return err;
-- 
2.56.0

[PATCH RESEND wireless-next 2/9] wifi: cfg80211: drop RTNL from disconnect_work

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

The RTNL here is only needed for walking the wiphy list,
which can be done under cfg80211_mutex instead, we just
need to not take it in regulatory_hint_disconnect(), of
which this is the only caller.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/wireless/reg.c | 2 +-
 net/wireless/reg.h | 2 +-
 net/wireless/sme.c | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 4efb35baeb3e..50f50e768f01 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -3671,7 +3671,7 @@ static bool is_wiphy_all_set_reg_flag(enum ieee80211_regulatory_flags flag)
 
 void regulatory_hint_disconnect(void)
 {
-	guard(mutex)(&cfg80211_mutex);
+	lockdep_assert_held(&cfg80211_mutex);
 
 	/* Restore of regulatory settings is not required when wiphy(s)
 	 * ignore IE from connected access point but clearance of beacon hints
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index c587079ead8f..76e7f9e8d684 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -115,7 +115,7 @@ void regulatory_hint_country_ie(struct wiphy *wiphy,
  * be respected but if a user had set the regulatory domain that will take
  * precedence.
  *
- * Must be called from process context.
+ * Must be called with cfg80211_mutex held.
  */
 void regulatory_hint_disconnect(void);
 
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 85076f3b3355..fde86c900f4f 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -704,10 +704,10 @@ static bool cfg80211_is_all_idle(void)
 
 static void disconnect_work(struct work_struct *work)
 {
-	rtnl_lock();
+	guard(mutex)(&cfg80211_mutex);
+
 	if (cfg80211_is_all_idle())
 		regulatory_hint_disconnect();
-	rtnl_unlock();
 }
 
 DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
-- 
2.56.0

[PATCH RESEND wireless-next 3/9] wifi: nl80211: don't hold RTNL for SET_SAR_SPECS

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

There's no need for the RTNL for setting SAR specs, it
seems to have just been added while I was removing the
RTNL from most places. Just drop it.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/wireless/nl80211.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index b5b9d8830af5..46b72f3b5ea4 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -20826,8 +20826,7 @@ static const struct genl_small_ops nl80211_small_ops[] = {
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 		.doit = nl80211_set_sar_specs,
 		.flags = GENL_UNS_ADMIN_PERM,
-		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
-					 NL80211_FLAG_NEED_RTNL),
+		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
 	},
 	{
 		.cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
-- 
2.56.0

[PATCH RESEND wireless-next 4/9] wifi: cfg80211: switch wiphy netns under cfg80211_mutex

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

Hold the cfg80211_mutex across the whole netns switch, so
we can walk the wiphy list without worrying about a wiphy
switching away to a different namespace underneath. This
will allow removing RTNL from netlink dumps.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/wireless/core.c | 3 +++
 net/wireless/core.h | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/wireless/core.c b/net/wireless/core.c
index 01b077909179..d648df6b8037 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -171,6 +171,9 @@ static int __cfg80211_switch_netns(struct cfg80211_registered_device *rdev,
 	struct wireless_dev *wdev, *tmp;
 	int err = 0;
 
+	/* make the whole switch atomic for cfg80211_mutex holders, e.g. dumps */
+	guard(mutex)(&cfg80211_mutex);
+
 	list_for_each_entry_safe(wdev, tmp, &rdev->wiphy.wdev_list, list) {
 		err = cfg80211_switch_wdev_netns(wdev, net);
 		if (!err)
diff --git a/net/wireless/core.h b/net/wireless/core.h
index dfcb9ed5035b..d327c7f4fc12 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -19,7 +19,7 @@
 #include "reg.h"
 
 
-/* protects the wiphy list and regulatory state */
+/* protects the wiphy list, wiphy netns changes and regulatory state */
 extern struct mutex cfg80211_mutex;
 
 #define WIPHY_IDX_INVALID	-1
-- 
2.56.0

[PATCH RESEND wireless-next 5/9] wifi: nl80211: avoid RTNL for wiphy/interface netlink dumps

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

The wiphy/interface netlink dumps only need the RTNL for
the list and, possibly, filtering by netdev. This can be
easily replaced now, do that.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/wireless/nl80211.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 46b72f3b5ea4..bf64cafa02fc 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3794,8 +3794,10 @@ static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
 		struct cfg80211_registered_device *rdev;
 		int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
 
-		netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
+		rcu_read_lock();
+		netdev = dev_get_by_index_rcu(sock_net(skb->sk), ifidx);
 		if (!netdev) {
+			rcu_read_unlock();
 			ret = -ENODEV;
 			goto out;
 		}
@@ -3804,6 +3806,7 @@ static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
 				netdev->ieee80211_ptr->wiphy);
 			state->filter_wiphy = rdev->wiphy_idx;
 		}
+		rcu_read_unlock();
 	}
 
 	ret = 0;
@@ -3818,18 +3821,18 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 	struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
 	struct cfg80211_registered_device *rdev;
 
-	rtnl_lock();
+	mutex_lock(&cfg80211_mutex);
 	if (!state) {
 		state = kzalloc_obj(*state);
 		if (!state) {
-			rtnl_unlock();
+			mutex_unlock(&cfg80211_mutex);
 			return -ENOMEM;
 		}
 		state->filter_wiphy = -1;
 		ret = nl80211_dump_wiphy_parse(skb, cb, state);
 		if (ret) {
 			kfree(state);
-			rtnl_unlock();
+			mutex_unlock(&cfg80211_mutex);
 			return ret;
 		}
 		cb->args[0] = (long)state;
@@ -3871,7 +3874,7 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 					cb->min_dump_alloc = 4096;
 					state->split_start = 0;
 					wiphy_unlock(&rdev->wiphy);
-					rtnl_unlock();
+					mutex_unlock(&cfg80211_mutex);
 					return 1;
 				}
 				idx--;
@@ -3881,7 +3884,7 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 		wiphy_unlock(&rdev->wiphy);
 		break;
 	}
-	rtnl_unlock();
+	mutex_unlock(&cfg80211_mutex);
 
 	state->start = idx;
 
@@ -4857,7 +4860,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
 	struct wireless_dev *wdev;
 	int ret;
 
-	rtnl_lock();
+	mutex_lock(&cfg80211_mutex);
 	if (!cb->args[2]) {
 		struct nl80211_dump_wiphy_state state = {
 			.filter_wiphy = -1,
@@ -4920,7 +4923,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
 
 	ret = skb->len;
  out_unlock:
-	rtnl_unlock();
+	mutex_unlock(&cfg80211_mutex);
 
 	return ret;
 }
-- 
2.56.0

[PATCH RESEND wireless-next 6/9] wifi: cfg80211: protect wiphy names with cfg80211_mutex

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

The RTNL is only used for wiphy names to serialize checking
for name collisions and setting the name, across all wiphys.
Since the wiphy list can be walked under the cfg80211_mutex,
use that instead.

In nl80211_set_wiphy() this requires taking it before the
wiphy mutex, and then the RTNL is no longer needed there at
all if the netdev is looked up under RCU. Since the netns of
the wiphy and its netdevs is now also stable under the
cfg80211_mutex, only the netdev unregistering needs to be
handled, by looking up the wdev again under the wiphy mutex.

Assisted-by: LLM
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/wireless/core.c    | 10 ++++-----
 net/wireless/nl80211.c | 47 ++++++++++++++++++++++++++++--------------
 2 files changed, 37 insertions(+), 20 deletions(-)

diff --git a/net/wireless/core.c b/net/wireless/core.c
index d648df6b8037..c9ad4f72e70d 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -94,7 +94,7 @@ static int cfg80211_dev_check_name(struct cfg80211_registered_device *rdev,
 	struct cfg80211_registered_device *rdev2;
 	int wiphy_idx, taken = -1, digits;
 
-	ASSERT_RTNL();
+	lockdep_assert_held(&cfg80211_mutex);
 
 	if (strlen(newname) > NL80211_WIPHY_NAME_MAXLEN)
 		return -EINVAL;
@@ -127,7 +127,7 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
 {
 	int result;
 
-	ASSERT_RTNL();
+	lockdep_assert_held(&cfg80211_mutex);
 	lockdep_assert_wiphy(&rdev->wiphy);
 
 	/* Ignore nop renames */
@@ -664,16 +664,16 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
 	if (requested_name && requested_name[0]) {
 		int rv;
 
-		rtnl_lock();
+		mutex_lock(&cfg80211_mutex);
 		rv = cfg80211_dev_check_name(rdev, requested_name);
 
 		if (rv < 0) {
-			rtnl_unlock();
+			mutex_unlock(&cfg80211_mutex);
 			goto use_default_name;
 		}
 
 		rv = dev_set_name(&rdev->wiphy.dev, "%s", requested_name);
-		rtnl_unlock();
+		mutex_unlock(&cfg80211_mutex);
 		if (rv)
 			goto use_default_name;
 	} else {
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index bf64cafa02fc..48262db9d5e3 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4299,17 +4299,18 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *rdev = NULL;
 	struct net_device *netdev = NULL;
-	struct wireless_dev *wdev;
+	struct wireless_dev *wdev = NULL;
 	int result = 0, rem_txq_params = 0;
 	struct nlattr *nl_txq_params;
-	u32 changed;
+	u32 changed, wdev_id = 0;
 	u8 retry_short = 0, retry_long = 0;
 	u32 frag_threshold = 0, rts_threshold = 0;
 	u8 coverage_class = 0;
 	u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
 	int radio_idx = -1;
 
-	rtnl_lock();
+	/* keeps the wiphy registered and its netns stable */
+	mutex_lock(&cfg80211_mutex);
 	/*
 	 * Try to find the wiphy and netdev. Normally this
 	 * function shouldn't need the netdev, but this is
@@ -4323,28 +4324,44 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 	if (info->attrs[NL80211_ATTR_IFINDEX]) {
 		int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
 
-		netdev = __dev_get_by_index(genl_info_net(info), ifindex);
-		if (netdev && netdev->ieee80211_ptr)
+		rcu_read_lock();
+		netdev = dev_get_by_index_rcu(genl_info_net(info), ifindex);
+		if (netdev && netdev->ieee80211_ptr) {
 			rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
-		else
-			netdev = NULL;
+			wdev_id = netdev->ieee80211_ptr->identifier;
+		}
+		rcu_read_unlock();
 	}
 
-	if (!netdev) {
+	if (!rdev) {
+		/* RCU for the wdev list walk, cfg80211_mutex keeps rdev */
+		rcu_read_lock();
 		rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
 						  info->attrs);
+		rcu_read_unlock();
 		if (IS_ERR(rdev)) {
-			rtnl_unlock();
+			mutex_unlock(&cfg80211_mutex);
 			return PTR_ERR(rdev);
 		}
-		wdev = NULL;
-		netdev = NULL;
-		result = 0;
-	} else
-		wdev = netdev->ieee80211_ptr;
+	}
 
 	guard(wiphy)(&rdev->wiphy);
 
+	/* the netdev may have been unregistered after the lookup */
+	if (wdev_id) {
+		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
+			if (wdev->identifier == wdev_id)
+				break;
+		}
+		if (list_entry_is_head(wdev, &rdev->wiphy.wdev_list, list)) {
+			mutex_unlock(&cfg80211_mutex);
+			return -ENODEV;
+		}
+		netdev = wdev->netdev;
+	} else {
+		netdev = NULL;
+	}
+
 	/*
 	 * end workaround code, by now the rdev is available
 	 * and locked, and wdev may or may not be NULL.
@@ -4353,7 +4370,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 	if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 		result = cfg80211_dev_rename(
 			rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
-	rtnl_unlock();
+	mutex_unlock(&cfg80211_mutex);
 
 	if (result)
 		return result;
-- 
2.56.0

[PATCH RESEND wireless-next 7/9] wifi: cfg80211: check wiphy name in wiphy_register()

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

We currently check names already in wiphy_new_nm(), but
that could technically race when two are registered at
the same time. Currently that only happens with hwsim,
which probably can't race, but it's confusing.

Do the check later, with cfg80211_mutex held, so it'll
always be precise.

Assisted-by: LLM
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/wireless/core.c | 39 +++++++++++++--------------------------
 1 file changed, 13 insertions(+), 26 deletions(-)

diff --git a/net/wireless/core.c b/net/wireless/core.c
index c9ad4f72e70d..09fb40fa67b0 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -660,33 +660,13 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
 	/* atomic_inc_return makes it start at 1, make it start at 0 */
 	rdev->wiphy_idx--;
 
-	/* give it a proper name */
-	if (requested_name && requested_name[0]) {
+	/* remember the name, used/checked during registration */
+	if (!requested_name || !requested_name[0] ||
+	    dev_set_name(&rdev->wiphy.dev, "%s", requested_name)) {
 		int rv;
 
-		mutex_lock(&cfg80211_mutex);
-		rv = cfg80211_dev_check_name(rdev, requested_name);
-
-		if (rv < 0) {
-			mutex_unlock(&cfg80211_mutex);
-			goto use_default_name;
-		}
-
-		rv = dev_set_name(&rdev->wiphy.dev, "%s", requested_name);
-		mutex_unlock(&cfg80211_mutex);
-		if (rv)
-			goto use_default_name;
-	} else {
-		int rv;
-
-use_default_name:
-		/* NOTE:  This is *probably* safe w/out holding rtnl because of
-		 * the restrictions on phy names.  Probably this call could
-		 * fail if some other part of the kernel (re)named a device
-		 * phyX.  But, might should add some locking and check return
-		 * value, and use a different name if this one exists?
-		 */
-		rv = dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
+		rv = dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d",
+				  rdev->wiphy_idx);
 		if (rv < 0) {
 			kfree(rdev);
 			return NULL;
@@ -1240,7 +1220,14 @@ int wiphy_register(struct wiphy *wiphy)
 	rtnl_lock();
 	mutex_lock(&cfg80211_mutex);
 	wiphy_lock(&rdev->wiphy);
-	res = device_add(&rdev->wiphy.dev);
+
+	/* use default name if the requested one isn't good */
+	res = cfg80211_dev_check_name(rdev, dev_name(&rdev->wiphy.dev));
+	if (res)
+		res = dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d",
+				   rdev->wiphy_idx);
+	if (!res)
+		res = device_add(&rdev->wiphy.dev);
 	if (res) {
 		wiphy_unlock(&rdev->wiphy);
 		mutex_unlock(&cfg80211_mutex);
-- 
2.56.0

[PATCH RESEND wireless-next 8/9] wifi: mac80211: don't hold RTNL for rate control algo

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

Back when we supported algorithm switching at runtime, this
was needed for the open_count check. Now we don't have that
any more, so the check and RTNL section can go away.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/mac80211/main.c | 4 +---
 net/mac80211/rate.c | 5 -----
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index ad7dfc07ee63..28480f983932 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1567,10 +1567,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 	if (result)
 		goto fail_flows;
 
-	rtnl_lock();
 	result = ieee80211_init_rate_ctrl_alg(local,
 					      hw->rate_control_algorithm);
-	rtnl_unlock();
 	if (result < 0) {
 		wiphy_debug(local->hw.wiphy,
 			    "Failed to initialize rate control algorithm\n");
@@ -1689,9 +1687,9 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
  fail_wiphy_register:
  fail_band:
 	rtnl_lock();
-	rate_control_deinitialize(local);
 	ieee80211_remove_interfaces(local);
 	rtnl_unlock();
+	rate_control_deinitialize(local);
  fail_rate:
 	ieee80211_txq_teardown_flows(local);
  fail_flows:
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index f75257a19064..10e6ad537261 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -1001,11 +1001,6 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
 {
 	struct rate_control_ref *ref;
 
-	ASSERT_RTNL();
-
-	if (local->open_count)
-		return -EBUSY;
-
 	if (ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) {
 		if (WARN_ON(!local->ops->set_rts_threshold))
 			return -EINVAL;
-- 
2.56.0

[PATCH RESEND wireless-next 9/9] wifi: mac80211: fix interface registration error path order

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

If we fail to register the inet/inet6 address notifiers,
wiphy_unregister() is called before removing interface,
but the default interface already exists at this point.
This could also lead to a deadlock as wiphy_unregister()
then waits for the interface to go away.

Change the order to remove the interfaces first.

Assisted-by: LLM
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/mac80211/main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 28480f983932..76e85754deff 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1683,12 +1683,12 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 #if defined(CONFIG_INET) || defined(CONFIG_IPV6)
  fail_ifa:
 #endif
-	wiphy_unregister(local->hw.wiphy);
- fail_wiphy_register:
- fail_band:
 	rtnl_lock();
 	ieee80211_remove_interfaces(local);
 	rtnl_unlock();
+	wiphy_unregister(local->hw.wiphy);
+ fail_wiphy_register:
+ fail_band:
 	rate_control_deinitialize(local);
  fail_rate:
 	ieee80211_txq_teardown_flows(local);
-- 
2.56.0

[syzbot ci] Re: wifi: further RTNL redux

[syzbot ci]

syzbot ci has tested the following series

[v1] wifi: further RTNL redux
https://lore.kernel.org/all/20261010160459.229064-11-johannes@sipsolutions.net
* [PATCH RESEND wireless-next 1/9] wifi: nl80211: avoid RTNL in nl80211_get_reg_do()
* [PATCH RESEND wireless-next 2/9] wifi: cfg80211: drop RTNL from disconnect_work
* [PATCH RESEND wireless-next 3/9] wifi: nl80211: don't hold RTNL for SET_SAR_SPECS
* [PATCH RESEND wireless-next 4/9] wifi: cfg80211: switch wiphy netns under cfg80211_mutex
* [PATCH RESEND wireless-next 5/9] wifi: nl80211: avoid RTNL for wiphy/interface netlink dumps
* [PATCH RESEND wireless-next 6/9] wifi: cfg80211: protect wiphy names with cfg80211_mutex
* [PATCH RESEND wireless-next 7/9] wifi: cfg80211: check wiphy name in wiphy_register()
* [PATCH RESEND wireless-next 8/9] wifi: mac80211: don't hold RTNL for rate control algo
* [PATCH RESEND wireless-next 9/9] wifi: mac80211: fix interface registration error path order

and found the following issues:
* KASAN: slab-use-after-free Read in NUM
* KASAN: slab-use-after-free Read in append_radio_msg

Full report is available here:
https://ci.syzbot.org/series/51e15aa3-1f1c-404d-b5c8-c1065c90bcb0

***

KASAN: slab-use-after-free Read in NUM

tree:      wireless-next
URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/wireless/wireless-next.git
base:      fbfa27d9b06f025c5f2cfa79d0e01e6400eeff2a
arch:      amd64
compiler:  Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
config:    https://ci.syzbot.org/builds/2d1bce7d-9b9b-4d15-9fb8-ca75e747b223/config

netlink: 76 bytes leftover after parsing attributes in process `syz.1.35'.
==================================================================
BUG: KASAN: slab-use-after-free in strlen+0x57/0x70
Read of size 1 at addr ffff888116dae800 by task syz.1.35/5916

CPU: 0 UID: 0 PID: 5916 Comm: syz.1.35 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
   53.418828][ T5916]
 <TASK>
 dump_stack_lvl+0xe8/0x150
 print_address_description+0x55/0x1e0
 print_report+0x58/0x70
 kasan_report+0x117/0x150
 strlen+0x57/0x70
 append_radio_msg+0x3cc/0x5f0
 mac80211_hwsim_new_radio+0x41cd/0x5750
 hwsim_new_radio_nl+0xd8b/0xf90
 genl_family_rcv_msg_doit+0x233/0x340
 genl_rcv_msg+0x614/0x7a0
 netlink_rcv_skb+0x226/0x4a0
 genl_rcv+0x28/0x40
 netlink_unicast+0x7bd/0x940
 netlink_sendmsg+0x813/0xb40
 sock_sendmsg_nosec+0x14e/0x190
 ____sys_sendmsg+0x54e/0x850
 ___sys_sendmsg+0x2a5/0x360
 __x64_sys_sendmsg+0x1b1/0x290
 do_syscall_64+0x166/0x520
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4941d9e1d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f493ffd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f4942026090 RCX: 00007f4941d9e1d9
RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000005
RBP: 00007f4941e35888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4942026128 R14: 00007f4942026090 R15: 00007ffdf55e71e8
 </TASK>

Allocated by task 5916:
 kasan_save_track+0x3e/0x80
 __kasan_kmalloc+0x93/0xb0
 __kmalloc_node_track_caller_noprof+0x4b4/0x720
 kstrdup+0x42/0x100
 kobject_set_name_vargs+0x61/0x110
 dev_set_name+0xe2/0x140
 wiphy_new_nm+0x710/0x1ae0
 ieee80211_alloc_hw_nm+0x3f3/0x1f00
 mac80211_hwsim_new_radio+0x1ea/0x5750
 hwsim_new_radio_nl+0xd8b/0xf90
 genl_family_rcv_msg_doit+0x233/0x340
 genl_rcv_msg+0x614/0x7a0
 netlink_rcv_skb+0x226/0x4a0
 genl_rcv+0x28/0x40
 netlink_unicast+0x7bd/0x940
 netlink_sendmsg+0x813/0xb40
 sock_sendmsg_nosec+0x14e/0x190
 ____sys_sendmsg+0x54e/0x850
 ___sys_sendmsg+0x2a5/0x360
 __x64_sys_sendmsg+0x1b1/0x290
 do_syscall_64+0x166/0x520
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5916:
 kasan_save_track+0x3e/0x80
 kasan_save_free_info+0x40/0x50
 __kasan_slab_free+0x5c/0x80
 kfree+0x1c5/0x650
 kobject_set_name_vargs+0xca/0x110
 dev_set_name+0xe2/0x140
 wiphy_register+0x214e/0x3290
 ieee80211_register_hw+0x3d72/0x4b30
 mac80211_hwsim_new_radio+0x3284/0x5750
 hwsim_new_radio_nl+0xd8b/0xf90
 genl_family_rcv_msg_doit+0x233/0x340
 genl_rcv_msg+0x614/0x7a0
 netlink_rcv_skb+0x226/0x4a0
 genl_rcv+0x28/0x40
 netlink_unicast+0x7bd/0x940
 netlink_sendmsg+0x813/0xb40
 sock_sendmsg_nosec+0x14e/0x190
 ____sys_sendmsg+0x54e/0x850
 ___sys_sendmsg+0x2a5/0x360
 __x64_sys_sendmsg+0x1b1/0x290
 do_syscall_64+0x166/0x520
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888116dae800
 which belongs to the cache kmalloc-64 of size 64
The buggy address is located 0 bytes inside of
 freed 64-byte region [ffff888116dae800, ffff888116dae840)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116dae
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 017ff00000000000 ffff8881000418c0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 10987624482
 post_alloc_hook+0x1f9/0x250
 get_page_from_freelist+0x2209/0x2280
 __alloc_frozen_pages_noprof+0x217/0x5a0
 allocate_slab+0x7d/0x620
 refill_objects+0x2d5/0x350
 __pcs_replace_empty_main+0x2c8/0x6c0
 __kmalloc_node_track_caller_noprof+0x548/0x720
 krealloc_node_align_noprof+0x19a/0x390
 add_sysfs_param+0x15f/0xb80
 kernel_add_sysfs_param+0x7f/0xe0
 param_sysfs_builtin+0x199/0x250
 param_sysfs_builtin_init+0x23/0x30
 do_one_initcall+0x250/0x870
 do_initcall_level+0x10a/0x1a0
 do_initcalls+0x59/0xa0
 kernel_init_freeable+0x29d/0x3e0
page last free pid 9 tgid 9 ts 10970419393 stack trace:
 __free_frozen_pages+0xc93/0xd90
 kasan_depopulate_vmalloc_pte+0x6d/0x90
 __apply_to_page_range+0xbd8/0x1420
 __kasan_release_vmalloc+0xa2/0xd0
 purge_vmap_node+0x220/0x960
 __purge_vmap_area_lazy+0x783/0xb40
 drain_vmap_area_work+0x27/0x40
 process_scheduled_works+0xc3d/0x1630
 worker_thread+0xa47/0xfb0
 kthread+0x38b/0x480
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30

Memory state around the buggy address:
 ffff888116dae700: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff888116dae780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888116dae800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
                   ^
 ffff888116dae880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff888116dae900: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
==================================================================


***

KASAN: slab-use-after-free Read in append_radio_msg

tree:      wireless-next
URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/wireless/wireless-next.git
base:      fbfa27d9b06f025c5f2cfa79d0e01e6400eeff2a
arch:      amd64
compiler:  Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
config:    https://ci.syzbot.org/builds/2d1bce7d-9b9b-4d15-9fb8-ca75e747b223/config
syz repro: https://ci.syzbot.org/findings/32e84c9a-2451-4ee9-8f84-a781e0011961/syz_repro

==================================================================
BUG: KASAN: slab-use-after-free in strlen+0x57/0x70 lib/string.c:402
Read of size 1 at addr ffff8881157eac40 by task syz.1.20/5852

CPU: 0 UID: 0 PID: 5852 Comm: syz.1.20 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 strlen+0x57/0x70 lib/string.c:402
 __fortify_strlen include/linux/fortify-string.h:218 [inline]
 append_radio_msg+0x3cc/0x5f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:4484
 hwsim_mcast_new_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:4519 [inline]
 mac80211_hwsim_new_radio+0x41cd/0x5750 drivers/net/wireless/virtual/mac80211_hwsim_main.c:6243
 hwsim_new_radio_nl+0xd8b/0xf90 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7061
 genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916
 sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800
 __sock_sendmsg net/socket.c:818 [inline]
 ____sys_sendmsg+0x54e/0x850 net/socket.c:2715
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2769
 __sys_sendmsg net/socket.c:2801 [inline]
 __do_sys_sendmsg net/socket.c:2806 [inline]
 __se_sys_sendmsg net/socket.c:2804 [inline]
 __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2804
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7e8f9e1d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd7e9e0b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fd7e9225fa0 RCX: 00007fd7e8f9e1d9
RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
RBP: 00007fd7e9035888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd7e9226038 R14: 00007fd7e9225fa0 R15: 00007ffc32258e48
 </TASK>

Allocated by task 5852:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kmalloc_node_track_caller_noprof+0x4b4/0x720 mm/slub.c:5545
 __kmemdup_nul mm/util.c:64 [inline]
 kstrdup+0x42/0x100 mm/util.c:84
 kobject_set_name_vargs+0x61/0x110 lib/kobject.c:274
 dev_set_name+0xe2/0x140 drivers/base/core.c:3564
 wiphy_new_nm+0x710/0x1ae0 net/wireless/core.c:665
 ieee80211_alloc_hw_nm+0x3f3/0x1f00 net/mac80211/main.c:858
 mac80211_hwsim_new_radio+0x1ea/0x5750 drivers/net/wireless/virtual/mac80211_hwsim_main.c:5747
 hwsim_new_radio_nl+0xd8b/0xf90 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7061
 genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916
 sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800
 __sock_sendmsg net/socket.c:818 [inline]
 ____sys_sendmsg+0x54e/0x850 net/socket.c:2715
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2769
 __sys_sendmsg net/socket.c:2801 [inline]
 __do_sys_sendmsg net/socket.c:2806 [inline]
 __se_sys_sendmsg net/socket.c:2804 [inline]
 __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2804
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5852:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:264 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6509 [inline]
 kfree+0x1c5/0x650 mm/slub.c:6802
 kobject_set_name_vargs+0xca/0x110 lib/kobject.c:293
 dev_set_name+0xe2/0x140 drivers/base/core.c:3564
 wiphy_register+0x214e/0x3290 net/wireless/core.c:1227
 ieee80211_register_hw+0x3d72/0x4b30 net/mac80211/main.c:1634
 mac80211_hwsim_new_radio+0x3284/0x5750 drivers/net/wireless/virtual/mac80211_hwsim_main.c:6188
 hwsim_new_radio_nl+0xd8b/0xf90 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7061
 genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916
 sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800
 __sock_sendmsg net/socket.c:818 [inline]
 ____sys_sendmsg+0x54e/0x850 net/socket.c:2715
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2769
 __sys_sendmsg net/socket.c:2801 [inline]
 __do_sys_sendmsg net/socket.c:2806 [inline]
 __se_sys_sendmsg net/socket.c:2804 [inline]
 __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2804
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff8881157eac40
 which belongs to the cache kmalloc-16 of size 16
The buggy address is located 0 bytes inside of
 freed 16-byte region [ffff8881157eac40, ffff8881157eac50)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8881157ea2c0 pfn:0x1157ea
flags: 0x17ff00000000200(workingset|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 017ff00000000200 ffff888100041640 ffffea00045d6b10 ffffea000415b550
raw: ffff8881157ea2c0 000000000080007f 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 9509757778
 create_dummy_stack mm/page_owner.c:121 [inline]
 register_dummy_stack+0x98/0x100 mm/page_owner.c:127
 init_page_owner+0x2e/0x600 mm/page_owner.c:145
 invoke_init_callbacks mm/page_ext.c:152 [inline]
 page_ext_init+0x511/0x550 mm/page_ext.c:485
 mm_core_init+0x97/0xb0 mm/mm_init.c:2685
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8881157eab00: 00 01 fc fc 00 00 fc fc 00 01 fc fc 00 01 fc fc
 ffff8881157eab80: 00 00 fc fc 00 00 fc fc fa fb fc fc fa fb fc fc
>ffff8881157eac00: fa fb fc fc 00 01 fc fc fa fb fc fc fa fb fc fc
                                           ^
 ffff8881157eac80: 00 02 fc fc 00 02 fc fc 00 00 fc fc 00 00 fc fc
 ffff8881157ead00: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 02 fc fc
==================================================================


***

If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
  Tested-by: syzbot@syzkaller.appspotmail.com

---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.

To test a fix for this bug, please reply with `#syz test`
(on a separate line) and attach the patch to the email.

Notes:
- The patch will be applied on top of the tested series (as an
  incremental fix).
- To test a new version of the whole series, please send it directly
  to syzbot@lists.linux.dev.
- Arguments like custom git repos and branches are not supported.