[PATCH 6.1.y] wifi: cfg80211: release locks on error in cfg80211_wext_siwgenie()

[PATCH 6.1.y] wifi: cfg80211: release locks on error in cfg80211_wext_siwgenie()

[Wentao Guan]

This error path returns while wdev_lock() is still held, so one
malformed IE request can permanently block later operations on this
wiphy. Route the error through out to release the lock.

Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Closes: https://lore.kernel.org/all/93db0eae-f479-4343-a126-59987ae0dc22@oracle.com/
Fixes: 8b921a899346 ("wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()")
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
---
 net/wireless/wext-sme.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index be121fa36c514..ba6d8827f64b3 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -352,8 +352,10 @@ int cfg80211_wext_siwgenie(struct net_device *dev,
 			/* nothing */
 		}
 
-		if (!for_each_element_completed(elem, extra, ie_len))
-			return -EINVAL;
+		if (!for_each_element_completed(elem, extra, ie_len)) {
+			err = -EINVAL;
+			goto out;
+		}
 
 		ie = kmemdup(extra, ie_len, GFP_KERNEL);
 		if (!ie) {
-- 
2.39.5

Re: [PATCH 6.1.y] wifi: cfg80211: release locks on error in cfg80211_wext_siwgenie()

[Greg KH]

On Mon, Oct 12, 2026 at 11:42:46PM +0800, Wentao Guan wrote:
> This error path returns while wdev_lock() is still held, so one
> malformed IE request can permanently block later operations on this
> wiphy. Route the error through out to release the lock.
> 
> Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
> Closes: https://lore.kernel.org/all/93db0eae-f479-4343-a126-59987ae0dc22@oracle.com/
> Fixes: 8b921a899346 ("wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()")
> Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
> ---
>  net/wireless/wext-sme.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
> index be121fa36c514..ba6d8827f64b3 100644
> --- a/net/wireless/wext-sme.c
> +++ b/net/wireless/wext-sme.c
> @@ -352,8 +352,10 @@ int cfg80211_wext_siwgenie(struct net_device *dev,
>  			/* nothing */
>  		}
>  
> -		if (!for_each_element_completed(elem, extra, ie_len))
> -			return -EINVAL;
> +		if (!for_each_element_completed(elem, extra, ie_len)) {
> +			err = -EINVAL;
> +			goto out;
> +		}
>  
>  		ie = kmemdup(extra, ie_len, GFP_KERNEL);
>  		if (!ie) {
> -- 
> 2.39.5
> 
> 

<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read:
    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>

Re: [PATCH 6.1.y] wifi: cfg80211: release locks on error in cfg80211_wext_siwgenie()

[Wentao Guan]

Hi,

> On Mon, Oct 12, 2026 at 11:42:46PM +0800, Wentao Guan wrote:
> > This error path returns while wdev_lock() is still held, so one
> > malformed IE request can permanently block later operations on this
> > wiphy. Route the error through out to release the lock.
> >
> > Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
> > Closes: https://lore.kernel.org/all/93db0eae-f479-4343-a126-59987ae0dc22@oracle.com/
> > Fixes: 8b921a899346 ("wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()")
> > Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
> > ---
> >  net/wireless/wext-sme.c | 6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
> > index be121fa36c514..ba6d8827f64b3 100644
> > --- a/net/wireless/wext-sme.c
> > +++ b/net/wireless/wext-sme.c
> > @@ -352,8 +352,10 @@ int cfg80211_wext_siwgenie(struct net_device *dev,
> >  /* nothing */
> >  }
> > 
> > - if (!for_each_element_completed(elem, extra, ie_len))
> > - return -EINVAL;
> > + if (!for_each_element_completed(elem, extra, ie_len)) {
> > + err = -EINVAL;
> > + goto out;
> > + }
> > 
> >  ie = kmemdup(extra, ie_len, GFP_KERNEL);
> >  if (!ie) {
> > --
> > 2.39.5
> >
> >
> 
> <formletter>
> 
> This is not the correct way to submit patches for inclusion in the
> stable kernel tree.  Please read:
>    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
> for how to do this properly.
> 
> </formletter>

> It or an equivalent fix must already exist in Linux mainline (upstream).
This is a trival fix for these stable trees, the problem is not existed in mainline 

> It must be obviously correct and tested.
It is clearly right.

> It cannot be bigger than 100 lines, with context.
It is small./ +4 lines -2 lines

> It must follow the Documentation/process/submitting-patches.rst rules.
Its fixes tags point to the stable backport commit ids.

>It must either fix a real bug that bothers people or just add a device ID. To elaborate on the former:
> It fixes a problem like an oops, a hang, data corruption, a real security issue, a hardware quirk, a build error (but not for things marked CONFIG_BROKEN), or some “oh, that’s not good” issue.
Its fixes a lock with out unlock, and we no need to backport f42d22d3f79639 
("wifi: cfg80211: define and use wiphy guard")
and guard for older kernel tree.

BRs
Wentao Guan

Re: [PATCH 6.1.y] wifi: cfg80211: release locks on error in cfg80211_wext_siwgenie()

[Greg KH]

On Tue, Oct 13, 2026 at 03:00:01PM +0800, Wentao Guan wrote:
> Hi,
> 
> > On Mon, Oct 12, 2026 at 11:42:46PM +0800, Wentao Guan wrote:
> > > This error path returns while wdev_lock() is still held, so one
> > > malformed IE request can permanently block later operations on this
> > > wiphy. Route the error through out to release the lock.
> > >
> > > Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
> > > Closes: https://lore.kernel.org/all/93db0eae-f479-4343-a126-59987ae0dc22@oracle.com/
> > > Fixes: 8b921a899346 ("wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()")
> > > Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
> > > ---
> > >  net/wireless/wext-sme.c | 6 ++++--
> > >  1 file changed, 4 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
> > > index be121fa36c514..ba6d8827f64b3 100644
> > > --- a/net/wireless/wext-sme.c
> > > +++ b/net/wireless/wext-sme.c
> > > @@ -352,8 +352,10 @@ int cfg80211_wext_siwgenie(struct net_device *dev,
> > >  /* nothing */
> > >  }
> > > 
> > > - if (!for_each_element_completed(elem, extra, ie_len))
> > > - return -EINVAL;
> > > + if (!for_each_element_completed(elem, extra, ie_len)) {
> > > + err = -EINVAL;
> > > + goto out;
> > > + }
> > > 
> > >  ie = kmemdup(extra, ie_len, GFP_KERNEL);
> > >  if (!ie) {
> > > --
> > > 2.39.5
> > >
> > >
> > 
> > <formletter>
> > 
> > This is not the correct way to submit patches for inclusion in the
> > stable kernel tree.  Please read:
> >    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
> > for how to do this properly.
> > 
> > </formletter>
> 
> > It or an equivalent fix must already exist in Linux mainline (upstream).
> This is a trival fix for these stable trees, the problem is not existed in mainline 

Then you need to document the heck out of this why it's not upstream,
what upstream commit fixes this id and why you can't just backport that
commit (or commits) instead.

And get the needed maintainers to agree that this fix is ok and for them
to review it.

> >It must either fix a real bug that bothers people or just add a device ID. To elaborate on the former:
> > It fixes a problem like an oops, a hang, data corruption, a real security issue, a hardware quirk, a build error (but not for things marked CONFIG_BROKEN), or some “oh, that’s not good” issue.
> Its fixes a lock with out unlock, and we no need to backport f42d22d3f79639 
> ("wifi: cfg80211: define and use wiphy guard")
> and guard for older kernel tree.

We have no problem backporting upstream patches to resolve issues.
Please always do that instead.

thanks,

greg k-h