Re: [PATCH 2/2] wifi: mac80211_hwsim: serialize radio removal with frame commands

[Johannes Berg <johannes@sipsolutions.net>]

On Wed, 2026-11-11 at 14:45 -0500, enderaoelyther@gmail.com wrote:
> 
> 
> The underlying problem is per-radio object lifetime, not command
> serialization. get_hwsim_data_ref_from_addr() returns a radio pointer
> after rhashtable_lookup_fast() has already ended its RCU read-side
> protection. A concurrent deletion can then unpublish and free that radio
> while a frame, TX-status, or PMSR command is still using the pointer.
> 
> I reworked the fix around a per-radio reference count.

I'm not convinced that's necessary.

There are three users of get_hwsim_data_ref_from_addr:

hwsim_tx_info_frame_received_nl() just doesn't do anything that sleeps,
so it could just use RCU protection directly?

hwsim_cloned_frame_received_nl() uses it twice - the inner use is not an
issue as above, and the outer one is just acquiring the mutex for
synchronization with ->started, but given that mac80211 will sync RCU in
stop that's perhaps just not needed at all? Or maybe hwsim just needs to
synchronize_net() on stop.

hwsim_pmsr_report_nl() uses the mutex for pmsr_request access/swap and
GFP_KERNEL, but both of those could change? might need some more work
for abort though, not sure.

Dunno if that's better overall? Maybe, maybe not.

johannes