The PTK packet-number state is published to RCU readers before the key is installed in firmware. If firmware rejects the key, the error path clears the pointer and immediately frees the state while an RX reader may still hold it. Defer the free until after an RCU grace period, matching the normal key removal path. Fixes: d066a530af8e ("wifi: iwlwifi: mvm: fix ptk_pn memory leak") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-6-astra Signed-off-by: Zhao Li --- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c index 5bd246e37943..b0c4f245c88f 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c @@ -4385,7 +4385,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw, key->hw_key_idx = STA_KEY_IDX_INVALID; if (ptk_pn) { RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL); - kfree(ptk_pn); + kfree_rcu(ptk_pn, rcu_head); } /* * can't add key for RX, but we don't need it -- 2.55.0 The PTK packet-number state is published to RCU readers before the key is installed in firmware. If firmware rejects the key, the error path clears the pointer and immediately frees the state while an RX reader may still hold it. Defer the free until after an RCU grace period, matching the normal key removal path. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-6-astra Signed-off-by: Zhao Li --- drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c index 3a4c8fda68d0..693f2092a781 100644 --- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c +++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c @@ -2265,7 +2265,7 @@ static int iwl_mld_set_key_add(struct iwl_mld *mld, if (ret) { if (ptk_pn) { RCU_INIT_POINTER(mld_sta->ptk_pn[keyidx], NULL); - kfree(ptk_pn); + kfree_rcu(ptk_pn, rcu_head); } return -EOPNOTSUPP; -- 2.55.0 During firmware restart, iwl_mld_add_link() can reuse a link that is already published in mld_vif->link[]. If link initialization fails, the common error path frees the link without clearing that pointer. A later firmware-add failure does clear the pointer, but then immediately frees the link while an RCU reader may still hold it. Clear mld_vif->link[] in the common error path and defer freeing dynamic links until after an RCU grace period, matching normal link removal. iwl_mld_link_from_mac80211() reads that same slot under the wiphy mutex, so a NULL link means the slot is already NULL; the common clear cannot discard another link. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-6-astra Signed-off-by: Zhao Li --- drivers/net/wireless/intel/iwlwifi/mld/link.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mld/link.c b/drivers/net/wireless/intel/iwlwifi/mld/link.c index 96e06940b34c..55b84801923d 100644 --- a/drivers/net/wireless/intel/iwlwifi/mld/link.c +++ b/drivers/net/wireless/intel/iwlwifi/mld/link.c @@ -541,15 +541,15 @@ int iwl_mld_add_link(struct iwl_mld *mld, ret = iwl_mld_add_link_to_fw(mld, bss_conf); if (ret) { RCU_INIT_POINTER(mld->fw_id_to_bss_conf[link->fw_id], NULL); - RCU_INIT_POINTER(mld_vif->link[bss_conf->link_id], NULL); goto free; } return ret; free: + RCU_INIT_POINTER(mld_vif->link[bss_conf->link_id], NULL); if (!is_deflink) - kfree(link); + kfree_rcu(link, rcu_head); return ret; } -- 2.55.0