wifi: nxpwifi: protect sta_list against concurrent add and delete

Browse source

nxpwifi_del_sta_entry() unlinks an entry from priv->sta_list without
holding priv->sta_list_spinlock.  The comment above it gives the
reason: the function is only reached from cfg80211_ops.del_station,
which runs under the wiphy mutex.

That mutex serialises this callback against other users of the same
lock, including wiphy_work items.  It covers neither of the two other
writers of the same list:

  nxpwifi_add_sta_entry()    from nxpwifi_uap_event_sta_assoc()
  nxpwifi_del_all_sta_list() from nxpwifi_uap_event_bss_idle()

Both run from nxpwifi_process_event() on the driver's main work queue,
a plain workqueue that never takes the wiphy lock, and both take
sta_list_spinlock around their update.  A station associating, or the
BSS going idle, can therefore modify priv->sta_list while a hostapd
del_station is walking it and unlinking an entry.

Take the lock here too.  As the traversal then runs under the write
lock, list_for_each_entry() replaces the _rcu variant, matching
nxpwifi_del_all_sta_list().

The same call path reaches nxpwifi_get_sta_entry() without
rcu_read_lock().  Entries are freed with kfree_rcu() and every other
caller holds it, so take it around the lookup as well.

Fixes: 73b01e57ed ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Tested-by: Jeff Chen <jeff.chen_1@nxp.com>
Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com>
Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com>

...

This commit is contained in:

Linmao Li 2026-08-07 21:25:53 +08:00 • committed by Jeff Chen

parent d24e8ac715

commit ff9b465ddb

2 changed files with 8 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

drivers/net/wireless/nxp/nxpwifi/cfg80211.c

View file

8

drivers/net/wireless/nxp/nxpwifi/util.c

View file