From nobody Mon Jun 29 06:34:30 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2H4jrXz6k5Br for ; Mon, 29 Jun 2026 06:34:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2H0ssJz4GTS for ; Mon, 29 Jun 2026 06:34:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714871; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9k9A7hRlv+LM6JUjRWEbyxg7UjXsTuS6vUNwd3t6b2s=; b=OUIhoS9+MdsLLa8ISLtbjEkQtx4A/ZJ8ytyuS/mQQVKSdpe9JZYMF0HXa3ewoFlFxry1J+ u08QiaWY797lJthIM+1FI0Ew7T5+m175chiKTQQwCMrwvtx2MBglSFO4gqarIpzWNCQZct oV+YpxyJ31QopjMlREi4p6S2voYlc9/13BUFZtOOiWepLpw54/KTECn1c68kd4ZLdeRPX7 cDDBQKhXVYMdmPYjTzKAA60HwXRaKfc2hMzg11a6wntzziHBZWfSA/x1jw9syI4rYHXNaC TDH+bK22BramveVloglNDwYyfj+Yy3Gem7dNZW65ygP4FFm7JpQu/ZG3TRvG1Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714871; a=rsa-sha256; cv=none; b=svYlqmrfZ27UlBJRM3dcMCbeqhCFUs7ypNefIoVI5z/Lx0GA242w44bD8KTs0XYUD9keoZ 75iCCmDKJegxIkvI3ivqdPJR+3PuhQoo9s5GZ+LmZxdR2Ks8r7e8gE70ieyJ6fnjXLLIug RqDWDNnCEmtzcAnj2r8JcQewlfqZ82Z+yIs1b56xMbJvYSqX2W+Tng2kXGqr7qfP1H7Yww FRCmQTD4DLpM1z96pgSam8SL83pQu0ay18IgrbtwH87n5OgyQC2X3W0WeeIsWniziSB0pC nTPZyi3vfLe9Sb9n/m6IkIKKA9IkY6eK5wbBq9Rg1Y8KhASY1VdPEf0mbNkN7Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714871; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9k9A7hRlv+LM6JUjRWEbyxg7UjXsTuS6vUNwd3t6b2s=; b=BVKCYvmyzlLSkEKxxNtAWUv4DHjwynGtEczdK0eYWB8nvHdDwNPKOeVkcZJ+oDvMgHOioy YTZHwWLeCoF2JC4CspHAAWlqVI1C9AhRllnxzDiSRnQf93rRa5RPkQLbjF6p2yPEQpvEZB 7bl7Blu7vu/kRgOc0rItyYHTpTRG21XsoQvqqI6x7Jgzp0fBN61D3Wjk7WNNoKeOIoPFwE uH3SDw4RE9xmojZMHCFhQaGd6NBhECD199GzEWM0zLZ1onsvuIrXfWQtBawZJt/4zYau2u DEXZHL3vBnJYv+1Ign46VvgYzM31UQy5VKzthbND8Q0TWuZKu2HSQXPNlaEMkA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2G72zLzmH3 for ; Mon, 29 Jun 2026 06:34:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 47022 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:30 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 4406a07e6f3e - stable/15 - LinuxKPI: 802.11: lock down mac80211 downcalls List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 4406a07e6f3e5844033061d7630fe731739faa18 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:30 +0000 Message-Id: <6a4211f6.47022.50b6d199@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=4406a07e6f3e5844033061d7630fe731739faa18 commit 4406a07e6f3e5844033061d7630fe731739faa18 Author: Bjoern A. Zeeb AuthorDate: 2026-06-05 10:22:38 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:53:51 +0000 LinuxKPI: 802.11: lock down mac80211 downcalls Add lock assertions and "might_sleep" annotations to various mac80211 operation downcalls into the driver. Make sure the code to these is all covered by locks--pushing more wiphy lock into the code--or lock assertions as well. Split up parts of the MC code up into an unlocked and locked version to avoid recurive locking. Sponsored by: The FreeBSD Foundation (cherry picked from commit 1c601bf516ebefb1670f5612316c501f2ae2654a) --- sys/compat/linuxkpi/common/src/linux_80211.c | 58 ++++++++++++++++++---- .../linuxkpi/common/src/linux_80211_macops.c | 19 +++++++ 2 files changed, 67 insertions(+), 10 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index f612b559df99..8e7e69833a00 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -511,6 +511,8 @@ lkpi_sync_chanctx_cw_from_rx_bw(struct ieee80211_hw *hw, enum ieee80211_sta_rx_bandwidth old_bw; uint32_t changed; + lockdep_assert_wiphy(hw->wiphy); + chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf, lockdep_is_held(&hw->wiphy->mtx)); if (chanctx_conf == NULL) @@ -749,6 +751,9 @@ lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, struct ieee80211_sta *sta, struct ieee80211_node *ni, bool updchnctx) { + if (updchnctx) + lockdep_assert_wiphy(hw->wiphy); + /* * Ensure rx_nss is at least 1 as otherwise drivers run into * unexpected problems. @@ -1944,7 +1949,7 @@ lkpi_ic_update_mcast_copy(void *arg, struct sockaddr_dl *sdl, u_int cnt) } static void -lkpi_update_mcast_filter(struct ieee80211com *ic) +lkpi_update_mcast_filter_locked(struct ieee80211com *ic) { struct lkpi_hw *lhw; struct ieee80211_hw *hw; @@ -1953,6 +1958,9 @@ lkpi_update_mcast_filter(struct ieee80211com *ic) bool scanning; lhw = ic->ic_softc; + hw = LHW_TO_HW(lhw); + + lockdep_assert_wiphy(hw->wiphy); LKPI_80211_LHW_SCAN_LOCK(lhw); scanning = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0; @@ -1967,7 +1975,6 @@ lkpi_update_mcast_filter(struct ieee80211com *ic) if (lhw->mc_all_multi || lhw->ops->prepare_multicast == NULL) flags |= FIF_ALLMULTI; - hw = LHW_TO_HW(lhw); mc = lkpi_80211_mo_prepare_multicast(hw, &lhw->mc_list); changed_flags = (lhw->mc_flags ^ flags) & FIF_FLAGS_MASK; @@ -1983,6 +1990,20 @@ lkpi_update_mcast_filter(struct ieee80211com *ic) LKPI_80211_LHW_MC_UNLOCK(lhw); } +static void +lkpi_update_mcast_filter(struct ieee80211com *ic) +{ + struct lkpi_hw *lhw; + struct ieee80211_hw *hw; + + lhw = ic->ic_softc; + hw = LHW_TO_HW(lhw); + + wiphy_lock(hw->wiphy); + lkpi_update_mcast_filter_locked(ic); + wiphy_unlock(hw->wiphy); +} + static enum ieee80211_bss_changed lkpi_update_dtim_tsf(struct ieee80211_vif *vif, struct ieee80211_node *ni, struct ieee80211vap *vap, const char *_f, int _l) @@ -2112,6 +2133,8 @@ lkpi_hw_conf_idle(struct ieee80211_hw *hw, bool new) int error; bool old; + lockdep_assert_wiphy(hw->wiphy); + old = hw->conf.flags & IEEE80211_CONF_IDLE; if (old == new) return; @@ -2129,8 +2152,12 @@ static enum ieee80211_bss_changed lkpi_disassoc(struct ieee80211_sta *sta, struct ieee80211_vif *vif, struct lkpi_hw *lhw) { - enum ieee80211_bss_changed changed; + struct ieee80211_hw *hw; struct lkpi_vif *lvif; + enum ieee80211_bss_changed changed; + + hw = LHW_TO_HW(lhw); + lockdep_assert_wiphy(hw->wiphy); changed = 0; sta->aid = 0; @@ -2141,7 +2168,7 @@ lkpi_disassoc(struct ieee80211_sta *sta, struct ieee80211_vif *vif, changed |= BSS_CHANGED_ASSOC; IMPROVE(); - lkpi_update_mcast_filter(lhw->ic); + lkpi_update_mcast_filter_locked(lhw->ic); /* * Executing the bss_info_changed(BSS_CHANGED_ASSOC) with @@ -2391,6 +2418,8 @@ lkpi_set_chanctx_conf(struct ieee80211_hw *hw, struct ieee80211_vif *vif, struct lkpi_chanctx *lchanctx; int error; + lockdep_assert_wiphy(hw->wiphy); + if (vif->bss_conf.chanctx_conf == chanctx_conf) { if (!changed_set) { IMPROVE("OBSOLETE?"); @@ -3069,7 +3098,7 @@ lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int lkpi_bss_info_change(hw, vif, bss_changed); /* Prepare_multicast && configure_filter. */ - lkpi_update_mcast_filter(vap->iv_ic); + lkpi_update_mcast_filter_locked(vap->iv_ic); out: wiphy_unlock(hw->wiphy); @@ -4192,12 +4221,13 @@ lkpi_ic_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], ic_printf(ic, "%s: conf_tx ac %u failed %d\n", __func__, ac, error); } - wiphy_unlock(hw->wiphy); bss_changed = BSS_CHANGED_QOS; lkpi_bss_info_change(hw, vif, bss_changed); /* Force MC init. */ - lkpi_update_mcast_filter(ic); + lkpi_update_mcast_filter_locked(ic); + + wiphy_unlock(hw->wiphy); ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid); @@ -4707,8 +4737,11 @@ lkpi_ic_scan_start(struct ieee80211com *ic) lvif = VAP_TO_LVIF(vap); vif = LVIF_TO_VIF(lvif); - if (vap->iv_state == IEEE80211_S_SCAN) + if (vap->iv_state == IEEE80211_S_SCAN) { + wiphy_lock(hw->wiphy); lkpi_hw_conf_idle(hw, false); + wiphy_unlock(hw->wiphy); + } LKPI_80211_LHW_SCAN_LOCK(lhw); lhw->scan_flags |= LKPI_LHW_SCAN_RUNNING; @@ -4961,7 +4994,8 @@ lkpi_ic_scan_start(struct ieee80211com *ic) return; } - lkpi_update_mcast_filter(ic); + wiphy_lock(hw->wiphy); + lkpi_update_mcast_filter_locked(ic); TRACE_SCAN(ic, "Starting HW_SCAN: scan_flags %b, " "ie_len %d, n_ssids %d, n_chan %d, common_ie_len %d [%d, %d]", lhw->scan_flags, LKPI_LHW_SCAN_BITS, hw_req->req.ie_len, @@ -4971,6 +5005,7 @@ lkpi_ic_scan_start(struct ieee80211com *ic) hw_req->ies.len[NL80211_BAND_5GHZ]); error = lkpi_80211_mo_hw_scan(hw, vif, hw_req); + wiphy_unlock(hw->wiphy); if (error != 0) { bool scan_done; int e; @@ -5116,8 +5151,11 @@ lkpi_ic_scan_end(struct ieee80211com *ic) /* Send PS to stop buffering if n80211 does not for us? */ - if (vap->iv_state == IEEE80211_S_SCAN) + if (vap->iv_state == IEEE80211_S_SCAN) { + wiphy_lock(hw->wiphy); lkpi_hw_conf_idle(hw, true); + wiphy_unlock(hw->wiphy); + } } /* diff --git a/sys/compat/linuxkpi/common/src/linux_80211_macops.c b/sys/compat/linuxkpi/common/src/linux_80211_macops.c index b2e88719e103..b07a2075491b 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211_macops.c +++ b/sys/compat/linuxkpi/common/src/linux_80211_macops.c @@ -218,6 +218,8 @@ lkpi_80211_mo_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif, struct lkpi_hw *lhw; int error; + lockdep_assert_wiphy(hw->wiphy); + /* * MUST NOT return EPERM as that is a "magic number 1" based on rtw88 * driver indicating hw_scan is not supported despite the ops call @@ -244,6 +246,8 @@ lkpi_80211_mo_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif) { struct lkpi_hw *lhw; + lockdep_assert_wiphy(hw->wiphy); + lhw = HW_TO_LHW(hw); if (lhw->ops->cancel_hw_scan == NULL) return; @@ -291,6 +295,8 @@ lkpi_80211_mo_prepare_multicast(struct ieee80211_hw *hw, struct lkpi_hw *lhw; u64 ptr; + /* This seems fine without the wiphy lock. */ + lhw = HW_TO_LHW(hw); if (lhw->ops->prepare_multicast == NULL) return (0); @@ -306,6 +312,8 @@ lkpi_80211_mo_configure_filter(struct ieee80211_hw *hw, unsigned int changed_fla { struct lkpi_hw *lhw; + lockdep_assert_wiphy(hw->wiphy); + lhw = HW_TO_LHW(hw); if (lhw->ops->configure_filter == NULL) return; @@ -429,6 +437,8 @@ lkpi_80211_mo_config(struct ieee80211_hw *hw, uint32_t changed) struct lkpi_hw *lhw; int error; + lockdep_assert_wiphy(hw->wiphy); + lhw = HW_TO_LHW(hw); if (lhw->ops->config == NULL) { error = EOPNOTSUPP; @@ -497,6 +507,9 @@ lkpi_80211_mo_add_chanctx(struct ieee80211_hw *hw, struct lkpi_chanctx *lchanctx; int error; + might_sleep(); + lockdep_assert_wiphy(hw->wiphy); + lhw = HW_TO_LHW(hw); if (lhw->ops->add_chanctx == NULL) { error = EOPNOTSUPP; @@ -520,6 +533,9 @@ lkpi_80211_mo_change_chanctx(struct ieee80211_hw *hw, { struct lkpi_hw *lhw; + might_sleep(); + lockdep_assert_wiphy(hw->wiphy); + lhw = HW_TO_LHW(hw); if (lhw->ops->change_chanctx == NULL) return; @@ -535,6 +551,9 @@ lkpi_80211_mo_remove_chanctx(struct ieee80211_hw *hw, struct lkpi_hw *lhw; struct lkpi_chanctx *lchanctx; + might_sleep(); + lockdep_assert_wiphy(hw->wiphy); + lhw = HW_TO_LHW(hw); if (lhw->ops->remove_chanctx == NULL) return;