From: Miri Korenblit Date: Wed, 5 Feb 2025 09:39:26 +0000 (+0200) Subject: wifi: mac80211: ensure sdata->work is canceled before initialized. X-Git-Tag: v6.15-rc1~160^2~184^2~42 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6c93fd502023dd919b5987ccbe990735410edd49;p=thirdparty%2Flinux.git wifi: mac80211: ensure sdata->work is canceled before initialized. This wiphy work is canceled when the iface is stopped, and shouldn't be queued for a non-running iface. If it happens to be queued for a non-running iface (due to a bug) it can cause a corruption of wiphy_work_list when ieee80211_setup_sdata is called. Make sure to cancel it in this case and warn on. Signed-off-by: Miri Korenblit Reviewed-by: Johannes Berg Link: https://patch.msgid.link/20250205110958.99204c767c10.I84ce27a239059f6009cee197b252549a11426046@changeid Signed-off-by: Johannes Berg --- diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index edb4ca333528d..d8b14ba95ae24 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -8,7 +8,7 @@ * Copyright 2008, Johannes Berg * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright (c) 2016 Intel Deutschland GmbH - * Copyright (C) 2018-2024 Intel Corporation + * Copyright (C) 2018-2025 Intel Corporation */ #include #include @@ -804,6 +804,9 @@ static void ieee80211_set_multicast_list(struct net_device *dev) */ static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata) { + if (WARN_ON(!list_empty(&sdata->work.entry))) + wiphy_work_cancel(sdata->local->hw.wiphy, &sdata->work); + /* free extra data */ ieee80211_free_keys(sdata, false);