Re: [PATCH 5.10/5.15] wifi: mac80211: mesh: release the channel if start fails

[Fedor Pchelkin]

On Thu, 08. Oct 14:51, Alexander Martyniuk wrote:
> From: Johannes Berg <johannes.berg@xxxxxxxxx>
> 
> commit ae97fff6495a8764bc0ef281cfe5444f701e527f upstream.
> 
> ieee80211_join_mesh() acquires a channel context and then calls
> ieee80211_start_mesh(), which can fail. In that case, the chanctx
> isn't released then interface removal will attempt to unassign it
> after it's removed from the driver, hitting:
> 
>   wlan0: Failed check-sdata-in-driver check, flags: 0x0
>   WARNING: net/mac80211/driver-ops.c:366 at drv_unassign_vif_chanctx
>    ieee80211_assign_link_chanctx
>    __ieee80211_link_release_channel
>    ieee80211_link_release_channel
>    ieee80211_teardown_sdata
>    unregister_netdevice_many_notify
>    _cfg80211_unregister_wdev
>    ieee80211_remove_interfaces
>    ieee80211_unregister_hw
>    mac80211_hwsim_del_radio
>    hwsim_exit_net
> 
> Correctly release the channel on start failures.
> 
> Assisted-by: LLM
> Reported-by: syzbot+63a84ea9c0f57d6133fa@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=63a84ea9c0f57d6133fa
> Fixes: 2b5e19677592 ("mac80211: cache mesh beacon")
> Link: https://patch.msgid.link/20260908122838.201719-21-johannes@xxxxxxxxxxxxxxxx
> Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
> Signed-off-by: Alexander Martyniuk <alexevgmart@xxxxxxxxx>
> ---
> Backport fix for CVE-2026-98326
>  net/mac80211/cfg.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
> index afb1ad3e6ea1..bae9588ea913 100644
> --- a/net/mac80211/cfg.c
> +++ b/net/mac80211/cfg.c
> @@ -2276,7 +2276,11 @@ static int ieee80211_join_mesh(struct wiphy *wiphy, struct net_device *dev,
>  	if (err)
>  		return err;
>  
> -	return ieee80211_start_mesh(sdata);
> +	err = ieee80211_start_mesh(sdata);
> +	if (err)
> +		ieee80211_vif_release_channel(sdata);

In 5.10/5.15 ieee80211_vif_release_channel() requires &sdata->local->mtx
to be held, it has the corresponding lockdep assertion.

Besides, the backport uses a different release-function, relevant for old
kernels.  I understand that's an adaptation but FWIW it's generally
recommended to write a brief backporter's comment above one's SoB line if
any non-trivial adaptation is done.