[PATCH AUTOSEL 6.18-6.6] wifi: iwlwifi: mvm: ignore sync frames when sync is disabled
From: Sasha Levin
Date: Mon Oct 19 2026 - 10:10:01 EST
From: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx>
[ Upstream commit a790f60cc4d7dc64a2d7cadb94a3d9f60392bed4 ]
Gate time-sync frame interception on the active flag so frames are not
queued after time-sync teardown.
Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx>
Link: https://patch.msgid.link/20260717172958.ac73ee199a25.Ic1489244f9b02da93060f0a0e5b300a73527f265@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@xxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---
LLM Generated explanations, may be completely bogus:
The local tree is **7.3.0-rc4** (`v7.3-rc4-27-gf0100363d8c37`). This
analysis is only about that checkout: the iwlwifi MVM time-sync path
exists here, and the two-line guard is a real teardown leak/drop fix.
===============================================================
PHASE 1: COMMIT MESSAGE FORENSICS
===============================================================
Step 1.1: PARSE THE SUBJECT LINE
Record: **[iwlwifi/mvm] [ignore/gate] intercept time-sync frames only
while time-sync is active**
Step 1.2: PARSE ALL COMMIT MESSAGE TAGS
Record:
- **Assisted-by:** GitHubCopilot:GPT-5.3-Codex
- **Signed-off-by:** Emmanuel Grumbach (author)
- **Link:** https://patch.msgid.link/20260717172958.ac73ee199a25.Ic14892
44f9b02da93060f0a0e5b300a73527f265@changeid
- **Signed-off-by:** Miri Korenblit (iwlwifi maintainer)
- **No Fixes:, Reported-by:, Tested-by:, Reviewed-by:, Acked-by:, or Cc:
stable** (absence is expected for this pipeline)
- Ignored: any pipeline “already selected” markers (none present beyond
a normal maintainer SOB)
Step 1.3: ANALYZE THE COMMIT BODY TEXT
Record:
- **Bug:** After time-sync teardown, matching TM/FTM frames are still
intercepted and queued.
- **Symptom:** Frames sit on `frame_list` instead of going through the
normal RX/TX-status path; they are not consumed by firmware time-sync
notifications once the feature is off.
- **Version info in message:** none.
- **Root cause (from message + code):** interception is keyed only on
`peer_addr`, which is left set after disable.
Step 1.4: DETECT HIDDEN BUG FIXES
Record: This is an explicit bug fix (not style). “Ignore … when
disabled” / “frames are not queued after teardown” is incomplete disable
handling, which produces an skb leak and dropped TM/FTM frames.
===============================================================
PHASE 2: DIFF ANALYSIS - LINE BY LINE
===============================================================
Step 2.1: INVENTORY THE CHANGES
Record:
- **File:** `drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h` (+4 /
~0; copyright year + 2-line guard)
- **Function:** `iwl_mvm_time_sync_frame()`
- **Scope:** single-file surgical fix
Step 2.2: UNDERSTAND THE CODE FLOW CHANGE
Record:
- **Before:** If `peer_addr` matches and the skb is a TM or FTM action
frame, queue it on `mvm->time_sync.frame_list` and return true (caller
skips `ieee80211_tx_status_skb` / `iwl_mvm_pass_packet_to_mac80211`).
- **After:** If `!mvm->time_sync.active`, return false immediately so
the frame takes the normal path.
- **Path:** RX NAPI and TX-status reclaim; not probe init.
Step 2.3: IDENTIFY THE BUG MECHANISM
Record:
- **Category:** logic/correctness + resource leak on teardown.
- **Mechanism:** `iwl_mvm_time_sync_config()` sets `active = (protocols
!= 0)` and purges `frame_list` when inactive, but still copies
`peer_addr`. The interceptor never consulted `active`, so after
disable it kept stealing matching frames.
- Compared with MLD: `iwl_mld_time_sync_frame()` already no-ops when
`mld->time_sync` is NULL after `iwl_mld_deinit_time_sync()`. MVM
stores time-sync in an embedded struct, so it needs the `active` flag.
Step 2.4: ASSESS THE FIX QUALITY
Record:
- Obviously correct: gate on the same flag config already uses.
- Minimal; no API/data-structure change.
- Regression risk is low. A remaining TOCTOU vs
`iwl_mvm_time_sync_config()` (mutex vs RX/TX softirq, no `READ_ONCE`)
is pre-existing; this closes the post-teardown window, which is the
user-visible bug.
===============================================================
PHASE 3: GIT HISTORY INVESTIGATION
===============================================================
Step 3.1: BLAME THE CHANGED LINES
Record:
- Interceptor introduced in **c7eca79def44f** (`wifi: iwlwifi: mvm:
report hardware timestamps in RX/TX status`, Avraham Stern,
2023-03-20).
- First appeared in **v6.4-rc1** (`git describe --contains
c7eca79def44f` → `v6.4-rc1~132^2~151^2~105`).
- `struct iwl_time_sync_data { frame_list, peer_addr, active }` is from
that same commit. The bug is old, not last-month code.
Step 3.2: FOLLOW THE FIXES: TAG
Record: No `Fixes:` tag. The incomplete disable path is
**cf85123a210fe** (`wifi: iwlwifi: mvm: support enabling and disabling
HW timestamping`, also v6.4-rc1): it stopped auto-enabling on station
add, added purge-on-disable, and removed `iwl_mvm_time_sync_sta_rm()`,
but did not gate `iwl_mvm_time_sync_frame()`.
Step 3.3: CHECK FILE HISTORY FOR RELATED CHANGES
Record (on this tree, path-limited):
- `a790f60cc4d7d` — this fix
- `08e6183ed2568` — wifi action-frame struct move
- `cf85123a210fe` — enable/disable HW timestamping
- `a2f49f7d52a9e` / `c7eca79def44f` — original time-sync
Standalone. Series tag is **3/8** of an iwlwifi-next bundle; patches 1–2
and 4–8 touch other files. This hunk does not depend on them.
Step 3.4: CHECK THE AUTHOR'S OTHER COMMITS
Record: Emmanuel Grumbach is a long-time iwlwifi developer. Nearby July
2026 commits are other iwlwifi correctness fixes. Maintainer **Miri
Korenblit** signed off and applied it.
Step 3.5: CHECK FOR DEPENDENT/PREREQUISITE COMMITS
Record: Needs `mvm->time_sync.active` and `iwl_mvm_time_sync_frame()`,
both present since v6.4 and in this 7.3 tree. Applies standalone.
===============================================================
PHASE 4: MAILING LIST AND EXTERNAL RESEARCH
===============================================================
Step 4.1: FIND THE ORIGINAL PATCH DISCUSSION
Record:
- `b4 dig -c a790f60cc4d7` → https://patch.msgid.link/20260717172958.ac7
3ee199a25.Ic1489244f9b02da93060f0a0e5b300a73527f265@changeid
- `b4 dig -a`: single **v1** series `[PATCH iwlwifi-next 0/8] wifi:
iwlwifi: updates - 07-17-2026`
- Cover letter: “A couple of fixes, features and cleanups.” This patch
is listed under Emmanuel’s fixes.
- Saved mbox: 9 messages (cover + 8 patches), **no review replies, NAKs,
or Cc: stable**.
- WebFetch of lore returned **403**; discussion recovered via `b4 dig
-m`.
Step 4.2: CHECK WHO REVIEWED THE PATCH
Record (`b4 dig -w`): Miri Korenblit, Johannes Berg
(`johannes@xxxxxxxxxxxxxxxx`), linux-wireless, Emmanuel Grumbach. Right
lists/maintainers; no extra Reviewed-by on this patch. Miri’s SOB is the
maintainer merge.
Step 4.3: SEARCH FOR THE BUG REPORT
Record: No Reported-by / bugzilla / syzbot. Bug is from code inspection
of teardown vs interceptor.
Step 4.4: CHECK FOR RELATED PATCHES AND SERIES
Record: Mixed iwlwifi-next series. This patch only changes `mvm/time-
sync.h`. Other patches are MLD/ACPI/debug and are **not** prerequisites.
Step 4.5: CHECK STABLE MAILING LIST HISTORY
Record: WebSearch of lore.kernel.org/stable for this subject found
**no** discussion. UNVERIFIED beyond that search (lore HTML 403).
===============================================================
PHASE 5: CODE SEMANTIC ANALYSIS
===============================================================
Step 5.1: IDENTIFY KEY FUNCTIONS IN THE DIFF
Record: `iwl_mvm_time_sync_frame()` only.
Step 5.2: TRACE CALLERS
Record:
1. `drivers/net/wireless/intel/iwlwifi/mvm/tx.c` — TX-status reclaim: if
interceptor returns true, skip `ieee80211_tx_status_skb()`.
2. `drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c` — RX: if true, skip
pass-to-mac80211.
Both are hot NAPI/TX-complete paths, but the match is rare (TM/FTM
action frames to a configured peer).
Step 5.3: TRACE CALLEES
Record: `ether_addr_equal()`, `ieee80211_is_timing_measurement()`,
`ieee80211_is_ftm()`, `skb_queue_tail()`. No alloc/locks in the inline
itself. Disable path: `iwl_mvm_time_sync_config()` under `mvm->mutex`
(from `iwl_mvm_set_hw_timestamp()` via mac80211 `set_hw_timestamp`).
Step 5.4: FOLLOW THE CALL CHAIN
Record:
- Enable/disable: userspace nl80211 `SET_HW_TIMESTAMP` →
`ieee80211_set_hw_timestamp()` → `iwl_mvm_set_hw_timestamp()` →
`iwl_mvm_time_sync_config()`.
- After disable, any later TM/FTM RX/TX for that `peer_addr` hits the
interceptor.
- Reachable from the air for RX (FTM/TM responses) once the feature was
enabled then disabled. Not a general unprivileged syscall crash path.
Step 5.5: SEARCH FOR SIMILAR PATTERNS
Record: MLD already treats “no time_sync object” as inactive. No second
MVM copy of this bug.
===============================================================
PHASE 6: CROSS-REFERENCING AGAINST THE LOCAL TREE
===============================================================
Step 6.1: DOES THE BUGGY CODE EXIST IN THIS TREE?
Record:
- Tree: **7.3.0-rc4** (`git describe HEAD` =
`v7.3-rc4-27-gf0100363d8c37`).
- `git merge-base --is-ancestor a790f60cc4d7 HEAD` succeeded (commit is
in this lineage; expected for mainline, not used as “already
selected”).
- Pre-fix interceptor and `time_sync.active` / `peer_addr` /
`frame_list` all exist here. Bug introduced in v6.4, **not** after
this tree.
Step 6.2: CHECK FOR BACKPORT COMPLICATIONS
Record: Current `time-sync.h` matches the patched form. Against the pre-
fix function (unchanged since c7eca79 except this guard), apply is
**clean**.
Step 6.3: CHECK IF RELATED FIXES ARE ALREADY HERE
Record: Only this commit implements the `active` gate. `ead65aa2d5155`
(“send time sync only if needed”) is unrelated.
===============================================================
PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT
===============================================================
Step 7.1: IDENTIFY THE SUBSYSTEM AND ITS CRITICALITY
Record: **wifi / iwlwifi MVM** (Intel wireless). **IMPORTANT** (very
common hardware), not core mm/VFS. Time-sync/HW timestamping is a
narrower slice of that driver.
Step 7.2: ASSESS SUBSYSTEM ACTIVITY
Record: iwlwifi is actively developed (many 2026 commits). This
particular file is mature (stable since 6.4 aside from the action-frame
helper move).
===============================================================
PHASE 8: IMPACT AND RISK ASSESSMENT
===============================================================
Step 8.1: DETERMINE WHO IS AFFECTED
Record: Intel iwlwifi **MVM** users who used nl80211 HW timestamping
(TM/FTM) and then disabled it, while TM/FTM frames for that peer
continue. Not universal.
Step 8.2: DETERMINE THE TRIGGER CONDITIONS
Record:
- Trigger: enable HW timestamp for a peer, then disable (`protocols ==
0`). `peer_addr` stays set; `active` is false; interceptor still
matched.
- Not every boot; requires that userspace API.
- After that, RX of matching FTM/TM frames from the network can keep
filling `frame_list`.
- Enable/disable typically needs netlink admin; subsequent RX leak can
be driven by frames on the air.
Step 8.3: DETERMINE THE FAILURE MODE SEVERITY
Record:
- Unbounded **skb leak** of intercepted frames (purge only runs on a
later inactive config).
- **Dropped** TM/FTM frames that should have gone to mac80211.
- **Missing TX status** (`ieee80211_tx_status_skb` skipped) for
intercepted TX frames.
- Not a panic, UAF, or filesystem corruption.
- **Severity: HIGH** for the leak/drop on a live packet path; feature is
uncommon so blast radius is limited.
Step 8.4: CALCULATE RISK-BENEFIT RATIO
Record:
- **Benefit:** stops post-disable frame theft, skb leak, and missing TX
completion. Small but real.
- **Risk:** very low (2 functional lines, same flag already used in
config).
- **Ratio:** favorable for any tree that has MVM time-sync (this 7.3
tree does).
===============================================================
PHASE 9: FINAL SYNTHESIS
===============================================================
Step 9.1: COMPILE THE EVIDENCE
**FOR backporting to this tree:**
- Real teardown bug: interceptor ignored `active` while `peer_addr`
survived disable.
- Consequences: skb leak, silent TM/FTM drops, skipped TX status.
- Two-line, obviously correct guard; no new API.
- Bug in code present since v6.4; this 7.3 tree has that code.
- Author + iwlwifi maintainer SOB; sent to linux-wireless / Johannes
Berg.
- Standalone; other 3/8 series patches not required.
- MLD already has the equivalent “don’t intercept after teardown”
behavior.
**AGAINST:**
- No `Fixes:` / `Reported-by` / syzbot / stable discussion.
- Path is niche (HW timestamping), not a crash/CVE-class bug.
- Commit message is short and Copilot-assisted.
- Mixed “fixes + features” series with no extra review on this patch.
**UNRESOLVED:**
- lore HTML 403; used b4 mbox instead.
- No public user reports found.
Step 9.2: APPLY THE STABLE RULES CHECKLIST
1. Obviously correct and tested? **PASS** — matches existing `active`
flag; merged by iwlwifi maintainer (no separate Tested-by).
2. Fixes a real bug that affects users? **PASS** — post-disable
intercept/leak/drop.
3. Important issue? **PASS** — unbounded skb leak and missing TX
completion on a packet path (not a panic; still user-visible).
4. Small and contained? **PASS** — one inline, +2 functional lines.
5. No new features or APIs? **PASS**
6. Can apply to the local tree? **PASS** — `time_sync.active` and
callers exist; hunk is trivial.
Step 9.3: CHECK FOR EXCEPTION CATEGORIES
Record: None (not a device ID / quirk / DT / build / docs exception).
Ordinary small driver correctness fix.
Step 9.4: MAKE YOUR DECISION
This tree’s iwlwifi MVM time-sync stack still has the disable path that
leaves `peer_addr` set. Without the `active` check, teardown is
incomplete: TM/FTM skbs are queued forever and never get TX status or
mac80211 RX. The patch is the same check MVM config already uses and
that MLD gets via a NULL time-sync object. That is in scope for this 7.3
tree and meets stable rules.
What it solves for users of this tree: after HW timestamping is turned
off, FTM/TM frames are delivered normally instead of leaking on
`frame_list`.
Risk vs benefit: two lines vs a real leak/drop; benefit wins.
No missing prerequisites in this checkout.
Verification:
- [Phase 1] Parsed tags: Assisted-by Copilot, SOB Grumbach + Korenblit,
msgid.link; no Fixes/Reported-by/Cc stable
- [Phase 2] Diff: +2-line `if (!mvm->time_sync.active) return false;` in
`iwl_mvm_time_sync_frame()`
- [Phase 2] Confirmed disable leaves `peer_addr` set in
`iwl_mvm_time_sync_config()` (`time-sync.c` around the `active =
protocols != 0` assignment and `skb_queue_purge`)
- [Phase 3] `git blame` parent: interceptor from c7eca79def44f
(v6.4-rc1); disable redesign cf85123a210fe (v6.4-rc1)
- [Phase 3] No Fixes: tag; related history limited to `mvm/time-sync.*`
- [Phase 3] `git merge-base --is-ancestor a790f60cc4d7 HEAD` — commit is
in this 7.3 lineage
- [Phase 4] `b4 dig -c/-a/-w/-m`: v1 iwlwifi-next 3/8, no replies;
recipients Korenblit, Johannes, linux-wireless
- [Phase 4] WebFetch lore 403; stable WebSearch found no thread
- [Phase 5] Callers: `mvm/tx.c` TX status, `mvm/rxmq.c` RX; userspace
via `set_hw_timestamp`
- [Phase 5] MLD equivalent already NULL-checks `time_sync` after deinit
- [Phase 6] `git describe HEAD` = v7.3-rc4-27; `make kernelversion` =
7.3.0-rc4; feature present
- [Phase 8] Failure mode: skb leak + dropped TM/FTM + skipped TX status;
severity HIGH on that path
- UNVERIFIED: public user reports; full lore HTML thread rendering
**YES**
drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h b/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h
index 2cfd0fb5e781a..7bdbacb640787 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h
@@ -1,6 +1,7 @@
/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
/*
* Copyright (C) 2022 Intel Corporation
+ * Copyright (C) 2026 Intel Corporation
*/
#ifndef __TIME_SYNC_H__
#define __TIME_SYNC_H__
@@ -19,6 +20,9 @@ int iwl_mvm_time_sync_config(struct iwl_mvm *mvm, const u8 *addr,
static inline
bool iwl_mvm_time_sync_frame(struct iwl_mvm *mvm, struct sk_buff *skb, u8 *addr)
{
+ if (!mvm->time_sync.active)
+ return false;
+
if (ether_addr_equal(mvm->time_sync.peer_addr, addr) &&
(ieee80211_is_timing_measurement(skb) || ieee80211_is_ftm(skb))) {
skb_queue_tail(&mvm->time_sync.frame_list, skb);
--
2.53.0