From: Johannes Berg This is invoked with the wiphy mutex held, not in an RCU critical section, fix the dereference accordingly. Fixes: 2f925427e27a ("wifi: mac80211: estimate expected throughput if not provided by driver/rc") Signed-off-by: Johannes Berg --- net/mac80211/sta_info.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c index a1759eba7b01..b380e3b3c044 100644 --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -2834,7 +2834,7 @@ static u32 sta_estimate_expected_throughput(struct sta_info *sta, u32 duration; u8 band; - conf = rcu_dereference(bss_conf->chanctx_conf); + conf = sdata_dereference(bss_conf->chanctx_conf, sta->sdata); if (!conf) return 0; band = conf->def.chan->band; -- 2.55.0 From: Johannes Berg Converting the station and chanctx lookups to wiphy_dereference() was correct for the function itself but removed the rcu_read_lock() for the later transmit, which requires it, as well. Fix that. Found with the ap_open_poll_sta hwsim test, which reports net/mac80211/tx.c:608 suspicious rcu_dereference_check() usage! (and four more like it). Fixes: 1c3f880ed00e ("wifi: mac80211: implement STA-mode peer probing") Signed-off-by: Johannes Berg --- net/mac80211/cfg.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index d42f8df9badc..23ae81b88669 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -5035,7 +5035,9 @@ static int ieee80211_probe_peer(struct wiphy *wiphy, struct net_device *dev, } local_bh_disable(); + rcu_read_lock(); ieee80211_xmit(sdata, sta, skb); + rcu_read_unlock(); local_bh_enable(); return 0; -- 2.55.0