[Midnightbsd-cvs] [MidnightBSD/src] 76ae6d: linuxkpi: 80211: fix lock/node leak and unsynched ...

[Lucas Holt]

  Branch: refs/heads/fix-iwlwifi-lkpi80211-assoc-panic
  Home:   https://github.com/MidnightBSD/src
  Commit: 76ae6d3e378a1d93c7668d9765409515f4e4e3d5
      https://github.com/MidnightBSD/src/commit/76ae6d3e378a1d93c7668d9765409515f4e4e3d5
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-26 (Fri, 26 Jun 2026)

  Changed paths:
    M sys/compat/linuxkpi/common/src/linux_80211.c

  Log Message:
  -----------
  linuxkpi: 80211: fix lock/node leak and unsynched TX in scan_to_auth

Backport association-failure path hardening from FreeBSD stable/14 to
lkpi_sta_scan_to_auth().  This file is still at ~13.5 content level and
is missing two fixes that lead to kernel memory-corruption panics
(__stack_chk_fail "stack overflow detected" / 0xdeadc0de use-after-free
faults / stack guard-page exhaustion) seen when an Intel AX210 (iwlwifi)
repeatedly fails to associate.

- The "lvif_bss_synched || lvif_bss != NULL" early return left
  LKPI_80211_LVIF_LOCK held and leaked the local ni reference.  Release
  both before returning EBUSY.

- lsta->txq_ready was set true before the iv_bss sync check, so a lost
  (*iv_update_bss) race let net80211 hand MGMT/AUTH frames to the driver
  for a station with no allocated queue, producing the "tx on invalid
  TXQ 65535" path (FreeBSD PR 274382).  Defer txq_ready and tie it to
  the synched state instead.

Builds clean (-Werror) as linuxkpi_wlan.ko.

Obtained from:	FreeBSD (stable/14)
PR:		274382 (FreeBSD)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply at anthropic.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications