From bd7a68c7c056f5c23a5c824de3be62a574b6528e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 4 Feb 2026 15:16:51 +0100 Subject: [PATCH] 5.15-stable patches added patches: wifi-cfg80211-cancel-wiphy_work-before-freeing-wiphy.patch wifi-cfg80211-fix-wiphy-delayed-work-queueing.patch wifi-cfg80211-fully-move-wiphy-work-to-unbound-workqueue.patch wifi-cfg80211-init-wiphy_work-before-allocating-rfkill-fails.patch wifi-cfg80211-use-system_unbound_wq-for-wiphy-work.patch --- queue-5.15/series | 5 + ...ncel-wiphy_work-before-freeing-wiphy.patch | 45 +++++++++ ...0211-fix-wiphy-delayed-work-queueing.patch | 46 +++++++++ ...move-wiphy-work-to-unbound-workqueue.patch | 55 +++++++++++ ..._work-before-allocating-rfkill-fails.patch | 97 +++++++++++++++++++ ...use-system_unbound_wq-for-wiphy-work.patch | 34 +++++++ 6 files changed, 282 insertions(+) create mode 100644 queue-5.15/wifi-cfg80211-cancel-wiphy_work-before-freeing-wiphy.patch create mode 100644 queue-5.15/wifi-cfg80211-fix-wiphy-delayed-work-queueing.patch create mode 100644 queue-5.15/wifi-cfg80211-fully-move-wiphy-work-to-unbound-workqueue.patch create mode 100644 queue-5.15/wifi-cfg80211-init-wiphy_work-before-allocating-rfkill-fails.patch create mode 100644 queue-5.15/wifi-cfg80211-use-system_unbound_wq-for-wiphy-work.patch diff --git a/queue-5.15/series b/queue-5.15/series index 16172d867c..03340db878 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -199,3 +199,8 @@ writeback-fix-100-cpu-usage-when-dirtytime_expire_interval-is-0.patch mptcp-avoid-dup-sub_closed-events-after-disconnect.patch pinctrl-meson-mark-the-gpio-controller-as-sleeping.patch team-move-team-device-type-change-at-the-end-of-team_port_add.patch +wifi-cfg80211-use-system_unbound_wq-for-wiphy-work.patch +wifi-cfg80211-fix-wiphy-delayed-work-queueing.patch +wifi-cfg80211-cancel-wiphy_work-before-freeing-wiphy.patch +wifi-cfg80211-fully-move-wiphy-work-to-unbound-workqueue.patch +wifi-cfg80211-init-wiphy_work-before-allocating-rfkill-fails.patch diff --git a/queue-5.15/wifi-cfg80211-cancel-wiphy_work-before-freeing-wiphy.patch b/queue-5.15/wifi-cfg80211-cancel-wiphy_work-before-freeing-wiphy.patch new file mode 100644 index 0000000000..61461261ed --- /dev/null +++ b/queue-5.15/wifi-cfg80211-cancel-wiphy_work-before-freeing-wiphy.patch @@ -0,0 +1,45 @@ +From 72d520476a2fab6f3489e8388ab524985d6c4b90 Mon Sep 17 00:00:00 2001 +From: Miri Korenblit +Date: Thu, 6 Mar 2025 12:37:59 +0200 +Subject: wifi: cfg80211: cancel wiphy_work before freeing wiphy + +From: Miri Korenblit + +commit 72d520476a2fab6f3489e8388ab524985d6c4b90 upstream. + +A wiphy_work can be queued from the moment the wiphy is allocated and +initialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the +rdev::wiphy_work is getting queued. + +If wiphy_free is called before the rdev::wiphy_work had a chance to run, +the wiphy memory will be freed, and then when it eventally gets to run +it'll use invalid memory. + +Fix this by canceling the work before freeing the wiphy. + +Fixes: a3ee4dc84c4e ("wifi: cfg80211: add a work abstraction with special semantics") +Signed-off-by: Miri Korenblit +Reviewed-by: Johannes Berg +Link: https://patch.msgid.link/20250306123626.efd1d19f6e07.I48229f96f4067ef73f5b87302335e2fd750136c9@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -1127,6 +1127,13 @@ void cfg80211_dev_free(struct cfg80211_r + { + struct cfg80211_internal_bss *scan, *tmp; + struct cfg80211_beacon_registration *reg, *treg; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&rdev->wiphy_work_lock, flags); ++ WARN_ON(!list_empty(&rdev->wiphy_work_list)); ++ spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags); ++ cancel_work_sync(&rdev->wiphy_work); ++ + rfkill_destroy(rdev->wiphy.rfkill); + list_for_each_entry_safe(reg, treg, &rdev->beacon_registrations, list) { + list_del(®->list); diff --git a/queue-5.15/wifi-cfg80211-fix-wiphy-delayed-work-queueing.patch b/queue-5.15/wifi-cfg80211-fix-wiphy-delayed-work-queueing.patch new file mode 100644 index 0000000000..31895bc7c0 --- /dev/null +++ b/queue-5.15/wifi-cfg80211-fix-wiphy-delayed-work-queueing.patch @@ -0,0 +1,46 @@ +From b743287d7a0007493f5cada34ed2085d475050b4 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 25 Jan 2024 09:51:09 +0100 +Subject: wifi: cfg80211: fix wiphy delayed work queueing + +From: Johannes Berg + +commit b743287d7a0007493f5cada34ed2085d475050b4 upstream. + +When a wiphy work is queued with timer, and then again +without a delay, it's started immediately but *also* +started again after the timer expires. This can lead, +for example, to warnings in mac80211's offchannel code +as reported by Jouni. Running the same work twice isn't +expected, of course. Fix this by deleting the timer at +this point, when queuing immediately due to delay=0. + +Cc: stable@vger.kernel.org +Reported-by: Jouni Malinen +Fixes: a3ee4dc84c4e ("wifi: cfg80211: add a work abstraction with special semantics") +Link: https://msgid.link/20240125095108.2feb0eaaa446.I4617f3210ed0e7f252290d5970dac6a876aa595b@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -5,7 +5,7 @@ + * Copyright 2006-2010 Johannes Berg + * Copyright 2013-2014 Intel Mobile Communications GmbH + * Copyright 2015-2017 Intel Deutschland GmbH +- * Copyright (C) 2018-2022 Intel Corporation ++ * Copyright (C) 2018-2024 Intel Corporation + */ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt +@@ -1624,6 +1624,7 @@ void wiphy_delayed_work_queue(struct wip + unsigned long delay) + { + if (!delay) { ++ del_timer(&dwork->timer); + wiphy_work_queue(wiphy, &dwork->work); + return; + } diff --git a/queue-5.15/wifi-cfg80211-fully-move-wiphy-work-to-unbound-workqueue.patch b/queue-5.15/wifi-cfg80211-fully-move-wiphy-work-to-unbound-workqueue.patch new file mode 100644 index 0000000000..a32e961cc8 --- /dev/null +++ b/queue-5.15/wifi-cfg80211-fully-move-wiphy-work-to-unbound-workqueue.patch @@ -0,0 +1,55 @@ +From e296c95eac655008d5a709b8cf54d0018da1c916 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 22 May 2024 12:41:25 +0200 +Subject: wifi: cfg80211: fully move wiphy work to unbound workqueue + +From: Johannes Berg + +commit e296c95eac655008d5a709b8cf54d0018da1c916 upstream. + +Previously I had moved the wiphy work to the unbound +system workqueue, but missed that when it restarts and +during resume it was still using the normal system +workqueue. Fix that. + +Fixes: 91d20ab9d9ca ("wifi: cfg80211: use system_unbound_wq for wiphy work") +Reviewed-by: Miriam Rachel Korenblit +Link: https://msgid.link/20240522124126.7ca959f2cbd3.I3e2a71ef445d167b84000ccf934ea245aef8d395@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/core.c | 2 +- + net/wireless/sysfs.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -427,7 +427,7 @@ static void cfg80211_wiphy_work(struct w + if (wk) { + list_del_init(&wk->entry); + if (!list_empty(&rdev->wiphy_work_list)) +- schedule_work(work); ++ queue_work(system_unbound_wq, work); + spin_unlock_irq(&rdev->wiphy_work_lock); + + wk->func(&rdev->wiphy, wk); +--- a/net/wireless/sysfs.c ++++ b/net/wireless/sysfs.c +@@ -5,7 +5,7 @@ + * + * Copyright 2005-2006 Jiri Benc + * Copyright 2006 Johannes Berg +- * Copyright (C) 2020-2021, 2023 Intel Corporation ++ * Copyright (C) 2020-2021, 2023-2024 Intel Corporation + */ + + #include +@@ -137,7 +137,7 @@ static int wiphy_resume(struct device *d + if (rdev->wiphy.registered && rdev->ops->resume) + ret = rdev_resume(rdev); + rdev->suspended = false; +- schedule_work(&rdev->wiphy_work); ++ queue_work(system_unbound_wq, &rdev->wiphy_work); + wiphy_unlock(&rdev->wiphy); + + if (ret) diff --git a/queue-5.15/wifi-cfg80211-init-wiphy_work-before-allocating-rfkill-fails.patch b/queue-5.15/wifi-cfg80211-init-wiphy_work-before-allocating-rfkill-fails.patch new file mode 100644 index 0000000000..f7166fd9e4 --- /dev/null +++ b/queue-5.15/wifi-cfg80211-init-wiphy_work-before-allocating-rfkill-fails.patch @@ -0,0 +1,97 @@ +From fc88dee89d7b63eeb17699393eb659aadf9d9b7c Mon Sep 17 00:00:00 2001 +From: Edward Adam Davis +Date: Tue, 18 Mar 2025 11:13:45 +0800 +Subject: wifi: cfg80211: init wiphy_work before allocating rfkill fails + +From: Edward Adam Davis + +commit fc88dee89d7b63eeb17699393eb659aadf9d9b7c upstream. + +syzbort reported a uninitialize wiphy_work_lock in cfg80211_dev_free. [1] + +After rfkill allocation fails, the wiphy release process will be performed, +which will cause cfg80211_dev_free to access the uninitialized wiphy_work +related data. + +Move the initialization of wiphy_work to before rfkill initialization to +avoid this issue. + +[1] +INFO: trying to register non-static key. +The code is fine but needs lockdep annotation, or maybe +you didn't initialize this object before use? +turning off the locking correctness validator. +CPU: 0 UID: 0 PID: 5935 Comm: syz-executor550 Not tainted 6.14.0-rc6-syzkaller-00103-g4003c9e78778 #0 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 + assign_lock_key kernel/locking/lockdep.c:983 [inline] + register_lock_class+0xc39/0x1240 kernel/locking/lockdep.c:1297 + __lock_acquire+0x135/0x3c40 kernel/locking/lockdep.c:5103 + lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851 + __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] + _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 + cfg80211_dev_free+0x30/0x3d0 net/wireless/core.c:1196 + device_release+0xa1/0x240 drivers/base/core.c:2568 + kobject_cleanup lib/kobject.c:689 [inline] + kobject_release lib/kobject.c:720 [inline] + kref_put include/linux/kref.h:65 [inline] + kobject_put+0x1e4/0x5a0 lib/kobject.c:737 + put_device+0x1f/0x30 drivers/base/core.c:3774 + wiphy_free net/wireless/core.c:1224 [inline] + wiphy_new_nm+0x1c1f/0x2160 net/wireless/core.c:562 + ieee80211_alloc_hw_nm+0x1b7a/0x2260 net/mac80211/main.c:835 + mac80211_hwsim_new_radio+0x1d6/0x54e0 drivers/net/wireless/virtual/mac80211_hwsim.c:5185 + hwsim_new_radio_nl+0xb42/0x12b0 drivers/net/wireless/virtual/mac80211_hwsim.c:6242 + genl_family_rcv_msg_doit+0x202/0x2f0 net/netlink/genetlink.c:1115 + genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] + genl_rcv_msg+0x565/0x800 net/netlink/genetlink.c:1210 + netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2533 + genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 + netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] + netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1338 + netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1882 + sock_sendmsg_nosec net/socket.c:718 [inline] + __sock_sendmsg net/socket.c:733 [inline] + ____sys_sendmsg+0xaaf/0xc90 net/socket.c:2573 + ___sys_sendmsg+0x135/0x1e0 net/socket.c:2627 + __sys_sendmsg+0x16e/0x220 net/socket.c:2659 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 + +Fixes: 72d520476a2f ("wifi: cfg80211: cancel wiphy_work before freeing wiphy") +Reported-by: syzbot+aaf0488c83d1d5f4f029@syzkaller.appspotmail.com +Close: https://syzkaller.appspot.com/bug?extid=aaf0488c83d1d5f4f029 +Tested-by: syzbot+aaf0488c83d1d5f4f029@syzkaller.appspotmail.com +Signed-off-by: Edward Adam Davis +Link: https://patch.msgid.link/tencent_258DD9121DDDB9DD9A1939CFAA0D8625B107@qq.com +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -546,6 +546,9 @@ use_default_name: + INIT_WORK(&rdev->mgmt_registrations_update_wk, + cfg80211_mgmt_registrations_update_wk); + spin_lock_init(&rdev->mgmt_registrations_lock); ++ INIT_WORK(&rdev->wiphy_work, cfg80211_wiphy_work); ++ INIT_LIST_HEAD(&rdev->wiphy_work_list); ++ spin_lock_init(&rdev->wiphy_work_lock); + + #ifdef CONFIG_CFG80211_DEFAULT_PS + rdev->wiphy.flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT; +@@ -563,9 +566,6 @@ use_default_name: + return NULL; + } + +- INIT_WORK(&rdev->wiphy_work, cfg80211_wiphy_work); +- INIT_LIST_HEAD(&rdev->wiphy_work_list); +- spin_lock_init(&rdev->wiphy_work_lock); + INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work); + INIT_WORK(&rdev->conn_work, cfg80211_conn_work); + INIT_WORK(&rdev->event_work, cfg80211_event_work); diff --git a/queue-5.15/wifi-cfg80211-use-system_unbound_wq-for-wiphy-work.patch b/queue-5.15/wifi-cfg80211-use-system_unbound_wq-for-wiphy-work.patch new file mode 100644 index 0000000000..f96aacc82d --- /dev/null +++ b/queue-5.15/wifi-cfg80211-use-system_unbound_wq-for-wiphy-work.patch @@ -0,0 +1,34 @@ +From 91d20ab9d9ca035527af503d00e1e30d6c375f2a Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 9 Oct 2023 10:18:01 +0200 +Subject: wifi: cfg80211: use system_unbound_wq for wiphy work + +From: Johannes Berg + +commit 91d20ab9d9ca035527af503d00e1e30d6c375f2a upstream. + +Since wiphy work items can run pretty much arbitrary +code in the stack/driver, it can take longer to run +all of this, so we shouldn't be using system_wq via +schedule_work(). Also, we lock the wiphy (which is +the reason this exists), so use system_unbound_wq. + +Reported-and-tested-by: Kalle Valo +Fixes: a3ee4dc84c4e ("wifi: cfg80211: add a work abstraction with special semantics") +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -1593,7 +1593,7 @@ void wiphy_work_queue(struct wiphy *wiph + list_add_tail(&work->entry, &rdev->wiphy_work_list); + spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags); + +- schedule_work(&rdev->wiphy_work); ++ queue_work(system_unbound_wq, &rdev->wiphy_work); + } + EXPORT_SYMBOL_GPL(wiphy_work_queue); + -- 2.47.3