[PATCH 1/2] wifi: mac80211: preserve RCU links during batch key removal

[PATCH 1/2] wifi: mac80211: preserve RCU links during batch key removal

[Weiming Shi]

list_del_rcu() deliberately leaves the removed key list node intact so
that concurrent ieee80211_iter_keys_rcu() readers can advance to the next
key. The batch removal paths immediately reuse that same node for a
private free list, overwriting its next pointer before synchronize_net().

Add a separate list node for batched key destruction and use it in all
existing batch removal paths. This preserves the RCU list links until the
grace period completes.

Fixes: ef044763a3ca ("mac80211: add atomic uploaded keys iterator")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 net/mac80211/key.c | 8 ++++----
 net/mac80211/key.h | 2 ++
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index f45e792abede..a69617d8d1c7 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -1100,7 +1100,7 @@ static void ieee80211_free_keys_iface(struct ieee80211_sub_if_data *sdata,
 		ieee80211_key_replace(key->sdata, NULL, key->sta,
 				      key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
 				      key, NULL);
-		list_add_tail(&key->list, keys);
+		list_add_tail(&key->free_list, keys);
 	}
 
 	ieee80211_debugfs_key_update_default(sdata);
@@ -1121,7 +1121,7 @@ void ieee80211_remove_link_keys(struct ieee80211_link_data *link,
 		ieee80211_key_replace(key->sdata, link, key->sta,
 				      key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
 				      key, NULL);
-		list_add_tail(&key->list, keys);
+		list_add_tail(&key->free_list, keys);
 	}
 }
 
@@ -1132,7 +1132,7 @@ void ieee80211_free_key_list(struct ieee80211_local *local,
 
 	lockdep_assert_wiphy(local->hw.wiphy);
 
-	list_for_each_entry_safe(key, tmp, keys, list)
+	list_for_each_entry_safe(key, tmp, keys, free_list)
 		__ieee80211_key_destroy(key, false);
 }
 
@@ -1159,7 +1159,7 @@ void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata,
 
 	if (!list_empty(&keys) || force_synchronize)
 		synchronize_net();
-	list_for_each_entry_safe(key, tmp, &keys, list)
+	list_for_each_entry_safe(key, tmp, &keys, free_list)
 		__ieee80211_key_destroy(key, false);
 
 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index 826e4e9387c5..f5a97213a559 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -63,6 +63,8 @@ struct ieee80211_key {
 
 	/* for sdata list */
 	struct list_head list;
+	/* for temporary lists during batch removal */
+	struct list_head free_list;
 
 	/* protected by key mutex */
 	unsigned int flags;
-- 
2.55.0

[PATCH 2/2] wifi: mac80211: fix link STA group key use-after-free

[Weiming Shi]

A group key installed for an MLO link STA is stored in link_sta->gtk[] and
sdata->key_list. Link STA removal currently frees the link STA without
removing these keys. A later key teardown then returns -ENOLINK before
unlinking the key, while its caller still queues the key for destruction.
This leaves a freed node on sdata->key_list and can also leave key->sta
dangling.

Remove a link STA's group keys while the link STA and driver link are still
present. During full station teardown, collect GTKs from every link
together with the pairwise keys, unlink all of them, wait for one
post-unlink network grace period, and then destroy the batch.

Also let removal of an already orphaned key reach the list unlink
bookkeeping when the link or link STA is gone. Keep -ENOLINK unchanged for
key installation.

BUG: KASAN: slab-use-after-free in ieee80211_remove_link_keys
Read of size 8 at addr ffff888028c3c818 by task exploit/5192
ieee80211_remove_link_keys (net/mac80211/key.c:1114)
ieee80211_vif_update_links (net/mac80211/link.c:192 net/mac80211/link.c:351)
ieee80211_vif_set_links (net/mac80211/link.c:408)
cfg80211_remove_link (net/wireless/util.c:2894)
nl80211_remove_link (net/wireless/nl80211.c:16312)
genl_family_rcv_msg_doit (net/netlink/genetlink.c:1117)
netlink_sendmsg (net/netlink/af_netlink.c:1889)
Kernel panic - not syncing: KASAN: panic_on_warn set ...

Fixes: ccdde7c74ffd ("wifi: mac80211: properly implement MLO key handling")
Reported-by: co+36935f8953d6874a@bugs.sh
Closes: https://lore.kernel.org/linux-wireless/s6BRFbJoyNpjUBu6NC9TdJxvXM9vpQsN1FcY@bugs.sh/
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 net/mac80211/key.c      | 55 +++++++++++++++++++++++++++++++++++------
 net/mac80211/key.h      |  3 +++
 net/mac80211/sta_info.c |  6 +++++
 3 files changed, 56 insertions(+), 8 deletions(-)

diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index a69617d8d1c7..b907258829f0 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -475,7 +475,7 @@ static int ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
 		return -EINVAL;
 
 	if (link_id >= 0) {
-		if (!link) {
+		if (!link && !sta) {
 			link = sdata_dereference(sdata->link[link_id], sdata);
 			if (!link)
 				return -ENOLINK;
@@ -484,7 +484,7 @@ static int ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
 		if (sta) {
 			link_sta = rcu_dereference_protected(sta->link[link_id],
 							     lockdep_is_held(&sta->local->hw.wiphy->mtx));
-			if (!link_sta)
+			if (!link_sta && new)
 				return -ENOLINK;
 		}
 	} else {
@@ -535,7 +535,7 @@ static int ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
 			if (new &&
 			    !(new->conf.flags & IEEE80211_KEY_FLAG_NO_AUTO_TX))
 				_ieee80211_set_tx_key(new, true);
-		} else {
+		} else if (link_sta) {
 			rcu_assign_pointer(link_sta->gtk[idx], new);
 		}
 		/* Only needed for transition from no key -> key.
@@ -1183,23 +1183,57 @@ void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata,
 	}
 }
 
-void ieee80211_free_sta_keys(struct ieee80211_local *local,
-			     struct sta_info *sta)
+static void ieee80211_remove_link_sta_keys(struct ieee80211_local *local,
+					   struct link_sta_info *link_sta,
+					   struct list_head *keys)
 {
 	struct ieee80211_key *key;
 	int i;
 
 	lockdep_assert_wiphy(local->hw.wiphy);
 
-	for (i = 0; i < ARRAY_SIZE(sta->deflink.gtk); i++) {
-		key = wiphy_dereference(local->hw.wiphy, sta->deflink.gtk[i]);
+	for (i = 0; i < ARRAY_SIZE(link_sta->gtk); i++) {
+		key = wiphy_dereference(local->hw.wiphy, link_sta->gtk[i]);
 		if (!key)
 			continue;
 		ieee80211_key_replace(key->sdata, NULL, key->sta,
 				      key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
 				      key, NULL);
+		list_add_tail(&key->free_list, keys);
+	}
+}
+
+void ieee80211_free_link_sta_keys(struct ieee80211_local *local,
+				  struct link_sta_info *link_sta)
+{
+	struct ieee80211_key *key, *tmp;
+	LIST_HEAD(keys);
+
+	ieee80211_remove_link_sta_keys(local, link_sta, &keys);
+	if (list_empty(&keys))
+		return;
+
+	synchronize_net();
+	list_for_each_entry_safe(key, tmp, &keys, free_list)
 		__ieee80211_key_destroy(key, key->sdata->vif.type ==
 					NL80211_IFTYPE_STATION);
+}
+
+void ieee80211_free_sta_keys(struct ieee80211_local *local,
+			     struct sta_info *sta)
+{
+	struct ieee80211_key *key, *tmp;
+	LIST_HEAD(keys);
+	int i;
+
+	lockdep_assert_wiphy(local->hw.wiphy);
+
+	for (i = 0; i < ARRAY_SIZE(sta->link); i++) {
+		struct link_sta_info *link_sta;
+
+		link_sta = wiphy_dereference(local->hw.wiphy, sta->link[i]);
+		if (link_sta)
+			ieee80211_remove_link_sta_keys(local, link_sta, &keys);
 	}
 
 	for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
@@ -1209,9 +1243,14 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local,
 		ieee80211_key_replace(key->sdata, NULL, key->sta,
 				      key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
 				      key, NULL);
+		list_add_tail(&key->free_list, &keys);
+	}
+
+	if (!list_empty(&keys))
+		synchronize_net();
+	list_for_each_entry_safe(key, tmp, &keys, free_list)
 		__ieee80211_key_destroy(key, key->sdata->vif.type ==
 					NL80211_IFTYPE_STATION);
-	}
 }
 
 void ieee80211_delayed_tailroom_dec(struct wiphy *wiphy,
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index f5a97213a559..e4ee89de9438 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -24,6 +24,7 @@
 struct ieee80211_local;
 struct ieee80211_sub_if_data;
 struct ieee80211_link_data;
+struct link_sta_info;
 struct sta_info;
 
 /**
@@ -167,6 +168,8 @@ void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata,
 			 bool force_synchronize);
 void ieee80211_free_sta_keys(struct ieee80211_local *local,
 			     struct sta_info *sta);
+void ieee80211_free_link_sta_keys(struct ieee80211_local *local,
+				  struct link_sta_info *link_sta);
 void ieee80211_reenable_keys(struct ieee80211_sub_if_data *sdata);
 int ieee80211_key_switch_links(struct ieee80211_sub_if_data *sdata,
 			       unsigned long del_links_mask,
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 22eba0e6e54c..cebfb2c4c0cc 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -3444,10 +3444,16 @@ int ieee80211_sta_activate_link(struct sta_info *sta, unsigned int link_id)
 void ieee80211_sta_remove_link(struct sta_info *sta, unsigned int link_id)
 {
 	struct ieee80211_sub_if_data *sdata = sta->sdata;
+	struct link_sta_info *link_sta;
 	u16 old_links = sta->sta.valid_links;
 
 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
 
+	link_sta = wiphy_dereference(sdata->local->hw.wiphy,
+				     sta->link[link_id]);
+	if (link_sta)
+		ieee80211_free_link_sta_keys(sta->local, link_sta);
+
 	sta->sta.valid_links &= ~BIT(link_id);
 
 	if (!WARN_ON(!test_sta_flag(sta, WLAN_STA_INSERTED)))
-- 
2.55.0