NACK/Cmnt: [SRU][J][PATCH 1/1] wifi: ath11k: update channel list in reg notifier instead reg worker
Andrei Gherzan
andrei.gherzan at canonical.com
Mon Sep 14 22:46:28 UTC 2026
On 26/09/09 08:06PM, Cengiz Can via kernel-team wrote:
> From: Wen Gong <quic_wgong at quicinc.com>
>
> Currently when ath11k gets a new channel list, it will be processed
> according to the following steps:
> 1. update new channel list to cfg80211 and queue reg_work.
> 2. cfg80211 handles new channel list during reg_work.
> 3. update cfg80211's handled channel list to firmware by
> ath11k_reg_update_chan_list().
>
> But ath11k will immediately execute step 3 after reg_work is just
> queued. Since step 2 is asynchronous, cfg80211 may not have completed
> handling the new channel list, which may leading to an out-of-bounds
> write error:
> BUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list
> Call Trace:
> ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k]
> kfree+0x109/0x3a0
> ath11k_regd_update+0x1cf/0x350 [ath11k]
> ath11k_regd_update_work+0x14/0x20 [ath11k]
> process_one_work+0xe35/0x14c0
>
> Should ensure step 2 is completely done before executing step 3. Thus
> Wen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set,
> cfg80211 will notify ath11k after step 2 is done.
>
> So enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will
> notify ath11k after step 2 is done. At this time, there will be no
> KASAN bug during the execution of the step 3.
>
> [1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/
>
> Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
>
> Fixes: f45cb6b29cd3 ("wifi: ath11k: avoid deadlock during regulatory update in ath11k_regd_update()")
> Signed-off-by: Wen Gong <quic_wgong at quicinc.com>
> Signed-off-by: Kang Yang <quic_kangyang at quicinc.com>
> Reviewed-by: Aditya Kumar Singh <quic_adisi at quicinc.com>
> Link: https://patch.msgid.link/20250117061737.1921-2-quic_kangyang@quicinc.com
> Signed-off-by: Jeff Johnson <jeff.johnson at oss.qualcomm.com>
> (backported from commit 933ab187e679e6fbdeea1835ae39efcc59c022d2)
> [bot_kybele: Dropped the cosmetic copyright bump (no Qualcomm line exists here)
> and called ath11k_reg_update_chan_list(ar) since this tree's function has no
> bool arg. Also backported the required prerequisite "patch [1]": added
We should have the prerequisite commit as another commit, not folded in this patch.
> WIPHY_FLAG_NOTIFY_REGDOM_BY_DRIVER=BIT(25) in cfg80211.h (BIT(24) is taken by
> HAS_STATIC_WEP here) and made reg_process_self_managed_hint() call
> reg_call_notifier() when the flag is set, otherwise cfg80211 never invokes the
> driver reg_notifier and the fix would neither build nor work.]
> CVE-2025-23133
> Assisted-by: kybele:claude-opus-4.8
> Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
> ---
> drivers/net/wireless/ath/ath11k/reg.c | 20 ++++++++++++++------
> include/net/cfg80211.h | 9 ++++++---
> net/wireless/reg.c | 3 +++
> 3 files changed, 23 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
> index 562ecfd50742..799e85d098bb 100644
> --- a/drivers/net/wireless/ath/ath11k/reg.c
> +++ b/drivers/net/wireless/ath/ath11k/reg.c
> @@ -52,6 +52,19 @@ ath11k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request)
> ath11k_dbg(ar->ab, ATH11K_DBG_REG,
> "Regulatory Notification received for %s\n", wiphy_name(wiphy));
>
> + if (request->initiator == NL80211_REGDOM_SET_BY_DRIVER) {
> + ath11k_dbg(ar->ab, ATH11K_DBG_REG,
> + "driver initiated regd update\n");
> + if (ar->state != ATH11K_STATE_ON)
> + return;
> +
> + ret = ath11k_reg_update_chan_list(ar);
> + if (ret)
> + ath11k_warn(ar->ab, "failed to update channel list: %d\n", ret);
> +
> + return;
> + }
> +
> /* Currently supporting only General User Hints. Cell base user
> * hints to be handled later.
> * Hints from other sources like Core, Beacons are not expected for
> @@ -254,12 +267,6 @@ int ath11k_regd_update(struct ath11k *ar)
> if (ret)
> goto err;
>
> - if (ar->state == ATH11K_STATE_ON) {
> - ret = ath11k_reg_update_chan_list(ar);
> - if (ret)
> - goto err;
> - }
> -
> return 0;
> err:
> ath11k_warn(ab, "failed to perform regd update : %d\n", ret);
> @@ -703,6 +710,7 @@ void ath11k_regd_update_work(struct work_struct *work)
> void ath11k_reg_init(struct ath11k *ar)
> {
> ar->hw->wiphy->regulatory_flags = REGULATORY_WIPHY_SELF_MANAGED;
> + ar->hw->wiphy->flags |= WIPHY_FLAG_NOTIFY_REGDOM_BY_DRIVER;
> ar->hw->wiphy->reg_notifier = ath11k_reg_notifier;
> }
>
> diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
> index 392576342661..c710fccce5ec 100644
> --- a/include/net/cfg80211.h
> +++ b/include/net/cfg80211.h
> @@ -4401,9 +4401,11 @@ struct cfg80211_ops {
> * beaconing mode (AP, IBSS, Mesh, ...).
> * @WIPHY_FLAG_HAS_STATIC_WEP: The device supports static WEP key installation
> * before connection.
> - * @WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK: The device supports bigger kek and kck keys
> - */
> -enum wiphy_flags {
> + * @WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK: The device supports bigger kek and kck keys
> + * @WIPHY_FLAG_NOTIFY_REGDOM_BY_DRIVER: The device could handle reg notify for
> + * NL80211_REGDOM_SET_BY_DRIVER.
> + */
These new doc line are gaining a leading space. checkkpatch agrees:
WARNING: please, no spaces at the start of a line
#61: FILE: include/net/cfg80211.h:4408:
+ enum wiphy_flags {
> + enum wiphy_flags {
There is an indentation issue here as well.
> WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK = BIT(0),
> /* use hole at 1 */
> WIPHY_FLAG_SPLIT_SCAN_6GHZ = BIT(2),
> @@ -4428,6 +4430,7 @@ enum wiphy_flags {
> WIPHY_FLAG_SUPPORTS_5_10_MHZ = BIT(22),
> WIPHY_FLAG_HAS_CHANNEL_SWITCH = BIT(23),
> WIPHY_FLAG_HAS_STATIC_WEP = BIT(24),
> + WIPHY_FLAG_NOTIFY_REGDOM_BY_DRIVER = BIT(25),
> };
>
> /**
> diff --git a/net/wireless/reg.c b/net/wireless/reg.c
> index f9a3c4f25e29..ba8df62d6b6c 100644
> --- a/net/wireless/reg.c
> +++ b/net/wireless/reg.c
> @@ -3142,6 +3142,9 @@ static void reg_process_self_managed_hint(struct wiphy *wiphy)
> request.alpha2[1] = regd->alpha2[1];
> request.initiator = NL80211_REGDOM_SET_BY_DRIVER;
>
> + if (wiphy->flags & WIPHY_FLAG_NOTIFY_REGDOM_BY_DRIVER)
> + reg_call_notifier(wiphy, &request);
> +
> nl80211_send_wiphy_reg_change_event(&request);
> }
--
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260914/4df08d1d/attachment.sig>
More information about the kernel-team
mailing list