* FAILED: patch "[PATCH] wifi: cfg80211: cancel rfkill_block work in" failed to apply to 6.1-stable tree
@ 2026-03-09 10:19 gregkh
2026-03-09 11:38 ` [PATCH 6.1.y 1/2] wifi: cfg80211: move scan done work to wiphy work Sasha Levin
0 siblings, 1 reply; 3+ messages in thread
From: gregkh @ 2026-03-09 10:19 UTC (permalink / raw)
To: d.dulov, johannes.berg; +Cc: stable
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 767d23ade706d5fa51c36168e92a9c5533c351a1
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026030934-undocked-comic-8b24@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 767d23ade706d5fa51c36168e92a9c5533c351a1 Mon Sep 17 00:00:00 2001
From: Daniil Dulov <d.dulov@aladdin.ru>
Date: Wed, 11 Feb 2026 11:20:24 +0300
Subject: [PATCH] wifi: cfg80211: cancel rfkill_block work in
wiphy_unregister()
There is a use-after-free error in cfg80211_shutdown_all_interfaces found
by syzkaller:
BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220
Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326
CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: events cfg80211_rfkill_block_work
Call Trace:
<TASK>
dump_stack_lvl+0x116/0x1f0
print_report+0xcd/0x630
kasan_report+0xe0/0x110
cfg80211_shutdown_all_interfaces+0x213/0x220
cfg80211_rfkill_block_work+0x1e/0x30
process_one_work+0x9cf/0x1b70
worker_thread+0x6c8/0xf10
kthread+0x3c5/0x780
ret_from_fork+0x56d/0x700
ret_from_fork_asm+0x1a/0x30
</TASK>
The problem arises due to the rfkill_block work is not cancelled when wiphy
is being unregistered. In order to fix the issue cancel the corresponding
work in wiphy_unregister().
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 1f87f7d3a3b4 ("cfg80211: add rfkill support")
Cc: stable@vger.kernel.org
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
Link: https://patch.msgid.link/20260211082024.1967588-1-d.dulov@aladdin.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 9af85d655027..d35cf04cbc81 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1212,6 +1212,7 @@ void wiphy_unregister(struct wiphy *wiphy)
/* this has nothing to do now but make sure it's gone */
cancel_work_sync(&rdev->wiphy_work);
+ cancel_work_sync(&rdev->rfkill_block);
cancel_work_sync(&rdev->conn_work);
flush_work(&rdev->event_work);
cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH 6.1.y 1/2] wifi: cfg80211: move scan done work to wiphy work 2026-03-09 10:19 FAILED: patch "[PATCH] wifi: cfg80211: cancel rfkill_block work in" failed to apply to 6.1-stable tree gregkh @ 2026-03-09 11:38 ` Sasha Levin 2026-03-09 11:38 ` [PATCH 6.1.y 2/2] wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() Sasha Levin 0 siblings, 1 reply; 3+ messages in thread From: Sasha Levin @ 2026-03-09 11:38 UTC (permalink / raw) To: stable; +Cc: Johannes Berg, Sasha Levin From: Johannes Berg <johannes.berg@intel.com> [ Upstream commit fe0af9fe54d0ff53aa49eef390c8962355b274e2 ] Move the scan done work to the new wiphy work to simplify the code a bit. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Stable-dep-of: 767d23ade706 ("wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()") Signed-off-by: Sasha Levin <sashal@kernel.org> --- net/wireless/core.c | 3 +-- net/wireless/core.h | 4 ++-- net/wireless/scan.c | 14 ++++---------- 3 files changed, 7 insertions(+), 14 deletions(-) diff --git a/net/wireless/core.c b/net/wireless/core.c index 2b6bdb7eaf18d..bc84953510e71 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -525,7 +525,7 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv, spin_lock_init(&rdev->bss_lock); INIT_LIST_HEAD(&rdev->bss_list); INIT_LIST_HEAD(&rdev->sched_scan_req_list); - INIT_WORK(&rdev->scan_done_wk, __cfg80211_scan_done); + wiphy_work_init(&rdev->scan_done_wk, __cfg80211_scan_done); INIT_DELAYED_WORK(&rdev->dfs_update_channels_wk, cfg80211_dfs_channels_update_work); #ifdef CONFIG_CFG80211_WEXT @@ -1125,7 +1125,6 @@ void wiphy_unregister(struct wiphy *wiphy) /* this has nothing to do now but make sure it's gone */ cancel_work_sync(&rdev->wiphy_work); - flush_work(&rdev->scan_done_wk); cancel_work_sync(&rdev->conn_work); flush_work(&rdev->event_work); cancel_delayed_work_sync(&rdev->dfs_update_channels_wk); diff --git a/net/wireless/core.h b/net/wireless/core.h index 17dfdf9fe7495..987c41b12856a 100644 --- a/net/wireless/core.h +++ b/net/wireless/core.h @@ -75,7 +75,7 @@ struct cfg80211_registered_device { struct sk_buff *scan_msg; struct list_head sched_scan_req_list; time64_t suspend_at; - struct work_struct scan_done_wk; + struct wiphy_work scan_done_wk; struct genl_info *cur_cmd_info; @@ -447,7 +447,7 @@ bool cfg80211_valid_key_idx(struct cfg80211_registered_device *rdev, int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev, struct key_params *params, int key_idx, bool pairwise, const u8 *mac_addr); -void __cfg80211_scan_done(struct work_struct *wk); +void __cfg80211_scan_done(struct wiphy *wiphy, struct wiphy_work *wk); void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool send_message); void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev, diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 7369172819fdf..a2cab0593366a 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -1096,16 +1096,9 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, nl80211_send_scan_msg(rdev, msg); } -void __cfg80211_scan_done(struct work_struct *wk) +void __cfg80211_scan_done(struct wiphy *wiphy, struct wiphy_work *wk) { - struct cfg80211_registered_device *rdev; - - rdev = container_of(wk, struct cfg80211_registered_device, - scan_done_wk); - - wiphy_lock(&rdev->wiphy); - ___cfg80211_scan_done(rdev, true); - wiphy_unlock(&rdev->wiphy); + ___cfg80211_scan_done(wiphy_to_rdev(wiphy), true); } void cfg80211_scan_done(struct cfg80211_scan_request *request, @@ -1131,7 +1124,8 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, } request->notified = true; - queue_work(cfg80211_wq, &wiphy_to_rdev(request->wiphy)->scan_done_wk); + wiphy_work_queue(request->wiphy, + &wiphy_to_rdev(request->wiphy)->scan_done_wk); } EXPORT_SYMBOL(cfg80211_scan_done); -- 2.51.0 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH 6.1.y 2/2] wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() 2026-03-09 11:38 ` [PATCH 6.1.y 1/2] wifi: cfg80211: move scan done work to wiphy work Sasha Levin @ 2026-03-09 11:38 ` Sasha Levin 0 siblings, 0 replies; 3+ messages in thread From: Sasha Levin @ 2026-03-09 11:38 UTC (permalink / raw) To: stable; +Cc: Daniil Dulov, Johannes Berg, Sasha Levin From: Daniil Dulov <d.dulov@aladdin.ru> [ Upstream commit 767d23ade706d5fa51c36168e92a9c5533c351a1 ] There is a use-after-free error in cfg80211_shutdown_all_interfaces found by syzkaller: BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220 Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326 CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events cfg80211_rfkill_block_work Call Trace: <TASK> dump_stack_lvl+0x116/0x1f0 print_report+0xcd/0x630 kasan_report+0xe0/0x110 cfg80211_shutdown_all_interfaces+0x213/0x220 cfg80211_rfkill_block_work+0x1e/0x30 process_one_work+0x9cf/0x1b70 worker_thread+0x6c8/0xf10 kthread+0x3c5/0x780 ret_from_fork+0x56d/0x700 ret_from_fork_asm+0x1a/0x30 </TASK> The problem arises due to the rfkill_block work is not cancelled when wiphy is being unregistered. In order to fix the issue cancel the corresponding work in wiphy_unregister(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 1f87f7d3a3b4 ("cfg80211: add rfkill support") Cc: stable@vger.kernel.org Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru> Link: https://patch.msgid.link/20260211082024.1967588-1-d.dulov@aladdin.ru Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> --- net/wireless/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/wireless/core.c b/net/wireless/core.c index bc84953510e71..e75326932c329 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -1125,6 +1125,7 @@ void wiphy_unregister(struct wiphy *wiphy) /* this has nothing to do now but make sure it's gone */ cancel_work_sync(&rdev->wiphy_work); + cancel_work_sync(&rdev->rfkill_block); cancel_work_sync(&rdev->conn_work); flush_work(&rdev->event_work); cancel_delayed_work_sync(&rdev->dfs_update_channels_wk); -- 2.51.0 ^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-09 11:38 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-03-09 10:19 FAILED: patch "[PATCH] wifi: cfg80211: cancel rfkill_block work in" failed to apply to 6.1-stable tree gregkh 2026-03-09 11:38 ` [PATCH 6.1.y 1/2] wifi: cfg80211: move scan done work to wiphy work Sasha Levin 2026-03-09 11:38 ` [PATCH 6.1.y 2/2] wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() Sasha Levin
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox