FAILED: patch "[PATCH] wifi: cfg80211: cancel rfkill_block work in" failed to apply to 5.15-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 767d23ade706d5fa51c36168e92a9c5533c351a1
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026030934-cocoa-wrangle-1781@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 767d23ade706d5fa51c36168e92a9c5533c351a1 Mon Sep 17 00:00:00 2001
From: Daniil Dulov <[email protected]>
Date: Wed, 11 Feb 2026 11:20:24 +0300
Subject: [PATCH] wifi: cfg80211: cancel rfkill_block work in
wiphy_unregister()
There is a use-after-free error in cfg80211_shutdown_all_interfaces found by syzkaller:
BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220 Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326 CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events cfg80211_rfkill_block_work Call Trace: <TASK> dump_stack_lvl+0x116/0x1f0 print_report+0xcd/0x630 kasan_report+0xe0/0x110 cfg80211_shutdown_all_interfaces+0x213/0x220 cfg80211_rfkill_block_work+0x1e/0x30 process_one_work+0x9cf/0x1b70 worker_thread+0x6c8/0xf10 kthread+0x3c5/0x780 ret_from_fork+0x56d/0x700 ret_from_fork_asm+0x1a/0x30 </TASK>
The problem arises due to the rfkill_block work is not cancelled when wiphy is being unregistered. In order to fix the issue cancel the corresponding work in wiphy_unregister().
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
net/wireless/core.c +1 -0
@@ -1212,6 +1212,7 @@ void wiphy_unregister(struct wiphy *wiphy)/* this has nothing to do now but make sure it's gone */ cancel_work_sync (&rdev->wiphy_work); +cancel_work_sync (&rdev->rfkill_block);cancel_work_sync (&rdev->conn_work);flush_work (&rdev->event_work);cancel_delayed_work_sync (&rdev->dfs_update_channels_wk);
Sasha Levin
maintainerPATCH 1/2 wifi: cfg80211: move scan done work to wiphy work
From: Johannes Berg <[email protected]>
[ Upstream commit fe0af9fe54d0ff53aa49eef390c8962355b274e2 ]
Move the scan done work to the new wiphy work to
simplify the code a bit.
Stable-dep-of: 767d23ade706 ("wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()")
--- net/wireless/core.c | 3 +-- net/wireless/core.h | 4 ++-- net/wireless/scan.c | 14 ++++---------- 3 files changed, 7 insertions(+), 14 deletions(-)
net/wireless/core.c +1 -2
@@ -525,7 +525,7 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,spin_lock_init (&rdev->bss_lock);INIT_LIST_HEAD (&rdev->bss_list);INIT_LIST_HEAD (&rdev->sched_scan_req_list); -INIT_WORK (&rdev->scan_done_wk, __cfg80211_scan_done); +wiphy_work_init (&rdev->scan_done_wk, __cfg80211_scan_done);INIT_DELAYED_WORK (&rdev->dfs_update_channels_wk, cfg80211_dfs_channels_update_work);#ifdef CONFIG_CFG80211_WEXT
@@ -1104,7 +1104,6 @@ void wiphy_unregister(struct wiphy *wiphy)/* this has nothing to do now but make sure it's gone */ cancel_work_sync (&rdev->wiphy_work); -flush_work (&rdev->scan_done_wk);cancel_work_sync (&rdev->conn_work);flush_work (&rdev->event_work);cancel_delayed_work_sync (&rdev->dfs_update_channels_wk);
net/wireless/core.h +2 -2
@@ -75,7 +75,7 @@ struct cfg80211_registered_device {struct sk_buff *scan_msg;struct list_head sched_scan_req_list;time64_t suspend_at; -struct work_struct scan_done_wk; +struct wiphy_work scan_done_wk;struct genl_info *cur_cmd_info;
@@ -445,7 +445,7 @@ bool cfg80211_valid_key_idx(struct cfg80211_registered_device *rdev,int cfg80211_validate_key_settings (struct cfg80211_registered_device *rdev,struct key_params *params,int key_idx,bool pairwise,const u8 *mac_addr); -void __cfg80211_scan_done (struct work_struct *wk); +void __cfg80211_scan_done (struct wiphy *wiphy,struct wiphy_work *wk);void ___cfg80211_scan_done (struct cfg80211_registered_device *rdev,bool send_message); void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev,
net/wireless/scan.c +4 -10
@@ -1079,16 +1079,9 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,nl80211_send_scan_msg (rdev, msg); } -void __cfg80211_scan_done (struct work_struct *wk) +void __cfg80211_scan_done (struct wiphy *wiphy,struct wiphy_work *wk) { -struct cfg80211_registered_device *rdev; - - rdev = container_of(wk, struct cfg80211_registered_device, - scan_done_wk); - -wiphy_lock (&rdev->wiphy); -___cfg80211_scan_done (rdev, true); -wiphy_unlock (&rdev->wiphy); +___cfg80211_scan_done (wiphy_to_rdev (wiphy), true); } void cfg80211_scan_done(struct cfg80211_scan_request *request,
@@ -1114,7 +1107,8 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, } request->notified = true; -queue_work (cfg80211_wq, &wiphy_to_rdev (request->wiphy)->scan_done_wk); +wiphy_work_queue (request->wiphy, + &wiphy_to_rdev (request->wiphy)->scan_done_wk); }EXPORT_SYMBOL (cfg80211_scan_done);
Signature · 1 line
2.51.0
Sasha Levin
maintainerPATCH 2/2 wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
From: Daniil Dulov <[email protected]>
[ Upstream commit 767d23ade706d5fa51c36168e92a9c5533c351a1 ]
There is a use-after-free error in cfg80211_shutdown_all_interfaces found by syzkaller:
BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220 Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326 CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events cfg80211_rfkill_block_work Call Trace: <TASK> dump_stack_lvl+0x116/0x1f0 print_report+0xcd/0x630 kasan_report+0xe0/0x110 cfg80211_shutdown_all_interfaces+0x213/0x220 cfg80211_rfkill_block_work+0x1e/0x30 process_one_work+0x9cf/0x1b70 worker_thread+0x6c8/0xf10 kthread+0x3c5/0x780 ret_from_fork+0x56d/0x700 ret_from_fork_asm+0x1a/0x30 </TASK>
The problem arises due to the rfkill_block work is not cancelled when wiphy is being unregistered. In order to fix the issue cancel the corresponding work in wiphy_unregister().
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- net/wireless/core.c | 1 + 1 file changed, 1 insertion(+)
net/wireless/core.c +1 -0
@@ -1104,6 +1104,7 @@ void wiphy_unregister(struct wiphy *wiphy)/* this has nothing to do now but make sure it's gone */ cancel_work_sync (&rdev->wiphy_work); +cancel_work_sync (&rdev->rfkill_block);cancel_work_sync (&rdev->conn_work);flush_work (&rdev->event_work);cancel_delayed_work_sync (&rdev->dfs_update_channels_wk);
Signature · 1 line
2.51.0