From aaf06d7cb648665bdff53a450809234326cbcfe7 Mon Sep 17 00:00:00 2001 From: Deepanshu Kartikey Date: Thu, 10 Sep 2026 09:40:47 +0530 Subject: [PATCH] wifi: mac80211: fix stats/preemption in ieee80211_tx_control_port() ieee80211_tx_control_port() can be called from nl80211_tx_control_port() in normal process context via netlink sendmsg(), where BH/preemption is not disabled. dev_sw_netstats_tx_add() uses this_cpu_ptr() internally, which requires preemption to be disabled, triggering a "BUG: using smp_processor_id() in preemptible code" warning. Fix this by moving the local_bh_disable()/local_bh_enable() section to also cover dev_sw_netstats_tx_add() and ieee80211_tpt_led_trig_tx(). Fixes: d5a014204a3b ("wifi: mac80211: tx: simplify control port frame transmission") Reported-by: syzbot+d979bd35c8a76fd1b6f5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d979bd35c8a76fd1b6f5 Signed-off-by: Deepanshu Kartikey Link: https://patch.msgid.link/20260910041047.24437-1-kartikey406@gmail.com Signed-off-by: Johannes Berg --- net/mac80211/tx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index d85c84a738f7..dc122d8cf9ad 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -6654,10 +6654,9 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev, return -EINVAL; } + local_bh_disable(); dev_sw_netstats_tx_add(dev, 1, skb->len); ieee80211_tpt_led_trig_tx(local, skb->len); - - local_bh_disable(); ieee80211_xmit(sdata, sta, skb); local_bh_enable(); rcu_read_unlock();