* [PATCH 2/2] wifi: mac80211: fix link STA group key use-after-free
2026-09-02 9:26 [PATCH 1/2] wifi: mac80211: preserve RCU links during batch key removal Weiming Shi
@ 2026-09-02 9:26 ` Weiming Shi
0 siblings, 0 replies; 2+ messages in thread
From: Weiming Shi @ 2026-09-02 9:26 UTC (permalink / raw)
To: Johannes Berg
Cc: Eliad Peller, Emmanuel Grumbach, Ilan Peer, linux-wireless,
linux-kernel, co+36935f8953d6874a, Xiang Mei, Weiming Shi,
stable
A group key installed for an MLO link STA is stored in link_sta->gtk[] and
sdata->key_list. Link STA removal currently frees the link STA without
removing these keys. A later key teardown then returns -ENOLINK before
unlinking the key, while its caller still queues the key for destruction.
This leaves a freed node on sdata->key_list and can also leave key->sta
dangling.
Remove a link STA's group keys while the link STA and driver link are still
present. During full station teardown, collect GTKs from every link
together with the pairwise keys, unlink all of them, wait for one
post-unlink network grace period, and then destroy the batch.
Also let removal of an already orphaned key reach the list unlink
bookkeeping when the link or link STA is gone. Keep -ENOLINK unchanged for
key installation.
BUG: KASAN: slab-use-after-free in ieee80211_remove_link_keys
Read of size 8 at addr ffff888028c3c818 by task exploit/5192
ieee80211_remove_link_keys (net/mac80211/key.c:1114)
ieee80211_vif_update_links (net/mac80211/link.c:192 net/mac80211/link.c:351)
ieee80211_vif_set_links (net/mac80211/link.c:408)
cfg80211_remove_link (net/wireless/util.c:2894)
nl80211_remove_link (net/wireless/nl80211.c:16312)
genl_family_rcv_msg_doit (net/netlink/genetlink.c:1117)
netlink_sendmsg (net/netlink/af_netlink.c:1889)
Kernel panic - not syncing: KASAN: panic_on_warn set ...
Fixes: ccdde7c74ffd ("wifi: mac80211: properly implement MLO key handling")
Reported-by: co+36935f8953d6874a@bugs.sh
Closes: https://lore.kernel.org/linux-wireless/s6BRFbJoyNpjUBu6NC9TdJxvXM9vpQsN1FcY@bugs.sh/
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
net/mac80211/key.c | 55 +++++++++++++++++++++++++++++++++++------
net/mac80211/key.h | 3 +++
net/mac80211/sta_info.c | 6 +++++
3 files changed, 56 insertions(+), 8 deletions(-)
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index a69617d8d1c7..b907258829f0 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -475,7 +475,7 @@ static int ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
return -EINVAL;
if (link_id >= 0) {
- if (!link) {
+ if (!link && !sta) {
link = sdata_dereference(sdata->link[link_id], sdata);
if (!link)
return -ENOLINK;
@@ -484,7 +484,7 @@ static int ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
if (sta) {
link_sta = rcu_dereference_protected(sta->link[link_id],
lockdep_is_held(&sta->local->hw.wiphy->mtx));
- if (!link_sta)
+ if (!link_sta && new)
return -ENOLINK;
}
} else {
@@ -535,7 +535,7 @@ static int ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
if (new &&
!(new->conf.flags & IEEE80211_KEY_FLAG_NO_AUTO_TX))
_ieee80211_set_tx_key(new, true);
- } else {
+ } else if (link_sta) {
rcu_assign_pointer(link_sta->gtk[idx], new);
}
/* Only needed for transition from no key -> key.
@@ -1183,23 +1183,57 @@ void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata,
}
}
-void ieee80211_free_sta_keys(struct ieee80211_local *local,
- struct sta_info *sta)
+static void ieee80211_remove_link_sta_keys(struct ieee80211_local *local,
+ struct link_sta_info *link_sta,
+ struct list_head *keys)
{
struct ieee80211_key *key;
int i;
lockdep_assert_wiphy(local->hw.wiphy);
- for (i = 0; i < ARRAY_SIZE(sta->deflink.gtk); i++) {
- key = wiphy_dereference(local->hw.wiphy, sta->deflink.gtk[i]);
+ for (i = 0; i < ARRAY_SIZE(link_sta->gtk); i++) {
+ key = wiphy_dereference(local->hw.wiphy, link_sta->gtk[i]);
if (!key)
continue;
ieee80211_key_replace(key->sdata, NULL, key->sta,
key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
key, NULL);
+ list_add_tail(&key->free_list, keys);
+ }
+}
+
+void ieee80211_free_link_sta_keys(struct ieee80211_local *local,
+ struct link_sta_info *link_sta)
+{
+ struct ieee80211_key *key, *tmp;
+ LIST_HEAD(keys);
+
+ ieee80211_remove_link_sta_keys(local, link_sta, &keys);
+ if (list_empty(&keys))
+ return;
+
+ synchronize_net();
+ list_for_each_entry_safe(key, tmp, &keys, free_list)
__ieee80211_key_destroy(key, key->sdata->vif.type ==
NL80211_IFTYPE_STATION);
+}
+
+void ieee80211_free_sta_keys(struct ieee80211_local *local,
+ struct sta_info *sta)
+{
+ struct ieee80211_key *key, *tmp;
+ LIST_HEAD(keys);
+ int i;
+
+ lockdep_assert_wiphy(local->hw.wiphy);
+
+ for (i = 0; i < ARRAY_SIZE(sta->link); i++) {
+ struct link_sta_info *link_sta;
+
+ link_sta = wiphy_dereference(local->hw.wiphy, sta->link[i]);
+ if (link_sta)
+ ieee80211_remove_link_sta_keys(local, link_sta, &keys);
}
for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
@@ -1209,9 +1243,14 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local,
ieee80211_key_replace(key->sdata, NULL, key->sta,
key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
key, NULL);
+ list_add_tail(&key->free_list, &keys);
+ }
+
+ if (!list_empty(&keys))
+ synchronize_net();
+ list_for_each_entry_safe(key, tmp, &keys, free_list)
__ieee80211_key_destroy(key, key->sdata->vif.type ==
NL80211_IFTYPE_STATION);
- }
}
void ieee80211_delayed_tailroom_dec(struct wiphy *wiphy,
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index f5a97213a559..e4ee89de9438 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -24,6 +24,7 @@
struct ieee80211_local;
struct ieee80211_sub_if_data;
struct ieee80211_link_data;
+struct link_sta_info;
struct sta_info;
/**
@@ -167,6 +168,8 @@ void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata,
bool force_synchronize);
void ieee80211_free_sta_keys(struct ieee80211_local *local,
struct sta_info *sta);
+void ieee80211_free_link_sta_keys(struct ieee80211_local *local,
+ struct link_sta_info *link_sta);
void ieee80211_reenable_keys(struct ieee80211_sub_if_data *sdata);
int ieee80211_key_switch_links(struct ieee80211_sub_if_data *sdata,
unsigned long del_links_mask,
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 22eba0e6e54c..cebfb2c4c0cc 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -3444,10 +3444,16 @@ int ieee80211_sta_activate_link(struct sta_info *sta, unsigned int link_id)
void ieee80211_sta_remove_link(struct sta_info *sta, unsigned int link_id)
{
struct ieee80211_sub_if_data *sdata = sta->sdata;
+ struct link_sta_info *link_sta;
u16 old_links = sta->sta.valid_links;
lockdep_assert_wiphy(sdata->local->hw.wiphy);
+ link_sta = wiphy_dereference(sdata->local->hw.wiphy,
+ sta->link[link_id]);
+ if (link_sta)
+ ieee80211_free_link_sta_keys(sta->local, link_sta);
+
sta->sta.valid_links &= ~BIT(link_id);
if (!WARN_ON(!test_sta_flag(sta, WLAN_STA_INSERTED)))
--
2.55.0
^ permalink raw reply [flat|nested] 2+ messages in thread