From b17e206e99598e51eb7862a719620647b35347c0 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Sun, 2 Aug 2026 10:40:10 +0200 Subject: [PATCH] wifi: mac80211: fix RCU usage in peer probing Converting the station and chanctx lookups to wiphy_dereference() was correct for the function itself but removed the rcu_read_lock() for the later transmit, which requires it, as well. Fix that. Found with the ap_open_poll_sta hwsim test, which reports net/mac80211/tx.c:608 suspicious rcu_dereference_check() usage! (and four more like it). Fixes: 1c3f880ed00e ("wifi: mac80211: implement STA-mode peer probing") Link: https://patch.msgid.link/20260802104010.6c09477032c4.If024b480b96bf9fe7baa821ed48b80be322d1e44@changeid Signed-off-by: Johannes Berg --- net/mac80211/cfg.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index 0c2c7afd59c4..23f4f9ec86d0 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -5054,7 +5054,9 @@ static int ieee80211_probe_peer(struct wiphy *wiphy, struct net_device *dev, } local_bh_disable(); + rcu_read_lock(); ieee80211_xmit(sdata, sta, skb); + rcu_read_unlock(); local_bh_enable(); return 0;