Re: [PATCH 1/4] wifi: ath10k: clear monitor interface after add failure

[Loic Poulain]

On Wed, Oct 28, 2026 at 6:04 AM Jiale Yao <yaojiale02@xxxxxxx> wrote:
>
> ath10k_add_interface() publishes the monitor vif before recalculating the
> monitor configuration. If that operation fails, the interface addition is
> unwound but monitor_arvif still points at the vif that mac80211 will free.
>
> Clear the published pointer before entering the common vdev cleanup path.
>
> Fixes: 500ff9f9389d ("ath10k: implement chanctx API")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>

This looks like a reasonable UAF fix to me.

Reviewed-by: Loic Poulain <loic.poulain@xxxxxxxxxxxxxxxx>

> ---
>  drivers/net/wireless/ath/ath10k/mac.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
> index 8e604697d6c2..36b694ae6de4 100644
> --- a/drivers/net/wireless/ath/ath10k/mac.c
> +++ b/drivers/net/wireless/ath/ath10k/mac.c
> @@ -5875,6 +5875,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
>                 ret = ath10k_monitor_recalc(ar);
>                 if (ret) {
>                         ath10k_warn(ar, "failed to recalc monitor: %d\n", ret);
> +                       ar->monitor_arvif = NULL;
>                         goto err_peer_delete;
>                 }
>         }
> --
> 2.34.1
>
>