The writable cfg80211.bss_entries_limit module parameter is currently parsed by the generic integer parameter setter, which accepts zero and negative values. When bss_entries_limit is set to zero, the first new BSS entry satisfies: rdev->bss_entries >= bss_entries_limit This causes __cfg80211_bss_update() to call cfg80211_bss_expire_oldest() while the BSS list has no eligible entry. The resulting NULL oldest entry triggers WARN_ON(!oldest). Add a custom parameter setter that preserves normal integer parsing but rejects values below one. Register it with module_param_call(), while preserving the original getter, permissions, compile-time type checking, and module parameter type metadata. Update the parameter description to document the minimum value. Fixes: 9853a55ef1bb ("cfg80211: limit scan results cache size") Cc: stable@vger.kernel.org Signed-off-by: Jiacheng Xu --- net/wireless/scan.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 071083cc3367..a14acc699dc4 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -71,9 +71,27 @@ * entries in total, so overhead is bigger.) */ static int bss_entries_limit = 1000; -module_param(bss_entries_limit, int, 0644); + +static int bss_entries_limit_set(const char *val, + const struct kernel_param *kp) +{ + int limit, ret; + + ret = kstrtoint(val, 0, &limit); + if (ret) + return ret; + if (limit < 1) + return -EINVAL; + + return param_set_int(val, kp); +} + +param_check_int(bss_entries_limit, &bss_entries_limit); +module_param_call(bss_entries_limit, bss_entries_limit_set, + param_get_int, &bss_entries_limit, 0644); +__MODULE_PARM_TYPE(bss_entries_limit, "int"); MODULE_PARM_DESC(bss_entries_limit, - "limit to number of scan BSS entries (per wiphy, default 1000)"); + "limit to number of scan BSS entries (per wiphy, default 1000, minimum 1)"); #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ)