[PATCH 1/3] wifi: iwlwifi: mvm: defer freeing PTK PN state on key failure

[PATCH 1/3] wifi: iwlwifi: mvm: defer freeing PTK PN state on key failure

[Zhao Li]

The PTK packet-number state is published to RCU readers before the key is
installed in firmware.

If firmware rejects the key, the error path clears the pointer and
immediately frees the state while an RX reader may still hold it.

Defer the free until after an RCU grace period, matching the normal key
removal path.

Fixes: d066a530af8e ("wifi: iwlwifi: mvm: fix ptk_pn memory leak")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 5bd246e37943..b0c4f245c88f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -4385,7 +4385,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
 			key->hw_key_idx = STA_KEY_IDX_INVALID;
 			if (ptk_pn) {
 				RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL);
-				kfree(ptk_pn);
+				kfree_rcu(ptk_pn, rcu_head);
 			}
 			/*
 			 * can't add key for RX, but we don't need it
-- 
2.55.0

[PATCH 2/3] wifi: iwlwifi: mld: defer freeing PTK PN state on key failure

[Zhao Li]

The PTK packet-number state is published to RCU readers before the key is
installed in firmware.

If firmware rejects the key, the error path clears the pointer and
immediately frees the state while an RX reader may still hold it.

Defer the free until after an RCU grace period, matching the normal key
removal path.

Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
 drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index 3a4c8fda68d0..693f2092a781 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -2265,7 +2265,7 @@ static int iwl_mld_set_key_add(struct iwl_mld *mld,
 	if (ret) {
 		if (ptk_pn) {
 			RCU_INIT_POINTER(mld_sta->ptk_pn[keyidx], NULL);
-			kfree(ptk_pn);
+			kfree_rcu(ptk_pn, rcu_head);
 		}
 
 		return -EOPNOTSUPP;
-- 
2.55.0

[PATCH 3/3] wifi: iwlwifi: mld: unpublish links before freeing on add failure

[Zhao Li]

During firmware restart, iwl_mld_add_link() can reuse a link that is
already published in mld_vif->link[]. If link initialization fails, the
common error path frees the link without clearing that pointer.

A later firmware-add failure does clear the pointer, but then immediately
frees the link while an RCU reader may still hold it.

Clear mld_vif->link[] in the common error path and defer freeing dynamic
links until after an RCU grace period, matching normal link removal.

iwl_mld_link_from_mac80211() reads that same slot under the wiphy mutex, so
a NULL link means the slot is already NULL; the common clear cannot discard
another link.

Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
 drivers/net/wireless/intel/iwlwifi/mld/link.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/link.c b/drivers/net/wireless/intel/iwlwifi/mld/link.c
index 96e06940b34c..55b84801923d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/link.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/link.c
@@ -541,15 +541,15 @@ int iwl_mld_add_link(struct iwl_mld *mld,
 	ret = iwl_mld_add_link_to_fw(mld, bss_conf);
 	if (ret) {
 		RCU_INIT_POINTER(mld->fw_id_to_bss_conf[link->fw_id], NULL);
-		RCU_INIT_POINTER(mld_vif->link[bss_conf->link_id], NULL);
 		goto free;
 	}
 
 	return ret;
 
 free:
+	RCU_INIT_POINTER(mld_vif->link[bss_conf->link_id], NULL);
 	if (!is_deflink)
-		kfree(link);
+		kfree_rcu(link, rcu_head);
 	return ret;
 }
 
-- 
2.55.0