[PATCH wireless-next 0/2] wifi: nxpwifi: fix sta_list locking and the deauth leak

[PATCH wireless-next 0/2] wifi: nxpwifi: fix sta_list locking and the deauth leak

[Linmao Li]

Two fixes for priv->sta_list in the uAP path, both found by reading the
station list locking model rather than from a report.

Patch 1 restores the writer lock in nxpwifi_del_sta_entry().  The list
has three writers; two of them take sta_list_spinlock, the third relies
on the cfg80211 mutex instead.  That mutex does not cover the other two,
because they run from firmware events on the driver's main work queue,
which never takes the wiphy lock.

Patch 2 deletes the station entry when the firmware reports
EVENT_UAP_STA_DEAUTH.  Nothing removes it today, so a station that has
left stays on the list until the BSS goes idle, and frames addressed to
it are requeued as intra-BSS traffic instead of going up the stack.

The order matters.  Patch 2 adds a second caller of
nxpwifi_del_sta_entry(), and that caller runs on the main work queue.
With patch 1 in front of it the two deletion paths serialise on
sta_list_spinlock and only one of them unlinks the node; the other
finds nothing and returns.  Applied the other way round, patch 2 would
widen the race that patch 1 fixes.

Neither patch has been tested on hardware -- I have no IW61x.  Both are
derived from the code paths, and both restore behaviour that mwifiex,
which nxpwifi was derived from, already has.

Linmao Li (2):
  wifi: nxpwifi: protect sta_list against concurrent add and delete
  wifi: nxpwifi: delete the station entry on the uAP deauth event

 drivers/net/wireless/nxp/nxpwifi/cfg80211.c  | 2 ++
 drivers/net/wireless/nxp/nxpwifi/uap_event.c | 1 +
 drivers/net/wireless/nxp/nxpwifi/util.c      | 8 ++++++--
 3 files changed, 9 insertions(+), 2 deletions(-)

-- 
2.25.1

[PATCH wireless-next 1/2] wifi: nxpwifi: protect sta_list against concurrent add and delete

[Linmao Li]

nxpwifi_del_sta_entry() unlinks an entry from priv->sta_list without
holding priv->sta_list_spinlock.  The comment above it gives the
reason: the function is only reached from cfg80211_ops.del_station,
which runs under the wiphy mutex.

That mutex serialises this callback against other users of the same
lock, including wiphy_work items.  It covers neither of the two other
writers of the same list:

  nxpwifi_add_sta_entry()    from nxpwifi_uap_event_sta_assoc()
  nxpwifi_del_all_sta_list() from nxpwifi_uap_event_bss_idle()

Both run from nxpwifi_process_event() on the driver's main work queue,
a plain workqueue that never takes the wiphy lock, and both take
sta_list_spinlock around their update.  A station associating, or the
BSS going idle, can therefore modify priv->sta_list while a hostapd
del_station is walking it and unlinking an entry.

Take the lock here too.  As the traversal then runs under the write
lock, list_for_each_entry() replaces the _rcu variant, matching
nxpwifi_del_all_sta_list().

The same call path reaches nxpwifi_get_sta_entry() without
rcu_read_lock().  Entries are freed with kfree_rcu() and every other
caller holds it, so take it around the lookup as well.

Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
---
 drivers/net/wireless/nxp/nxpwifi/cfg80211.c | 2 ++
 drivers/net/wireless/nxp/nxpwifi/util.c     | 8 ++++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c
index 5cc8cdf594d3e..939177bcc6cde 100644
--- a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c
+++ b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c
@@ -1539,9 +1539,11 @@ nxpwifi_cfg80211_del_station(struct wiphy *wiphy, struct wireless_dev *wdev,
 
 	eth_zero_addr(deauth_mac);
 
+	rcu_read_lock();
 	sta_node = nxpwifi_get_sta_entry(priv, params->mac);
 	if (sta_node)
 		ether_addr_copy(deauth_mac, params->mac);
+	rcu_read_unlock();
 
 	if (is_valid_ether_addr(deauth_mac)) {
 		ret = nxpwifi_uap_sta_deauth(priv, deauth_mac);
diff --git a/drivers/net/wireless/nxp/nxpwifi/util.c b/drivers/net/wireless/nxp/nxpwifi/util.c
index bbfefb81d8d3b..ae8444a141058 100644
--- a/drivers/net/wireless/nxp/nxpwifi/util.c
+++ b/drivers/net/wireless/nxp/nxpwifi/util.c
@@ -1041,19 +1041,23 @@ nxpwifi_set_sta_ht_cap(struct nxpwifi_private *priv, const u8 *ies,
 	}
 }
 
-/* Delete a station from list; called under cfg80211 mutex. */
+/* Delete a station from list. */
 
 void nxpwifi_del_sta_entry(struct nxpwifi_private *priv, const u8 *mac)
 {
 	struct nxpwifi_sta_node *node;
 
-	list_for_each_entry_rcu(node, &priv->sta_list, list) {
+	spin_lock_bh(&priv->sta_list_spinlock);
+
+	list_for_each_entry(node, &priv->sta_list, list) {
 		if (!memcmp(node->mac_addr, mac, ETH_ALEN)) {
 			list_del_rcu(&node->list);
 			kfree_rcu(node, rcu);
 			break;
 		}
 	}
+
+	spin_unlock_bh(&priv->sta_list_spinlock);
 }
 
 /* Delete all stations from list. */
-- 
2.25.1

[PATCH wireless-next 2/2] wifi: nxpwifi: delete the station entry on the uAP deauth event

[Linmao Li]

When a station leaves, the firmware reports EVENT_UAP_STA_DEAUTH.
nxpwifi_uap_event_sta_deauth() tears down the reorder, BA and WMM state
for that peer but leaves its nxpwifi_sta_node on priv->sta_list.

Nothing else removes it.  cfg80211_del_sta() only reports the departure
upwards, it does not call back into cfg80211_ops.del_station, and that
callback is the only caller of nxpwifi_del_sta_entry().  The entry
therefore survives until the BSS goes idle and
nxpwifi_del_all_sta_list() drops everything.

Until then the departed station still looks associated to the driver.
nxpwifi_handle_uap_rx_forward() finds the stale node for that address,
treats the frame as intra-BSS traffic and requeues it for transmission
instead of passing it up the stack, so traffic for that address is
misrouted.  The list also keeps one entry per station that has ever
associated, and a station that comes back reuses the stale node along
with its old statistics.

mwifiex, which nxpwifi was derived from, deletes the entry in the same
event handler.

Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
---
 drivers/net/wireless/nxp/nxpwifi/uap_event.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/nxp/nxpwifi/uap_event.c b/drivers/net/wireless/nxp/nxpwifi/uap_event.c
index 9f717a3d7ec5d..f053a5db01ab7 100644
--- a/drivers/net/wireless/nxp/nxpwifi/uap_event.c
+++ b/drivers/net/wireless/nxp/nxpwifi/uap_event.c
@@ -75,6 +75,7 @@ nxpwifi_uap_event_sta_deauth(struct nxpwifi_private *priv)
 		nxpwifi_del_tx_ba_stream_tbl_by_ra(priv, deauth_mac);
 	}
 	nxpwifi_wmm_del_peer_ra_list(priv, deauth_mac);
+	nxpwifi_del_sta_entry(priv, deauth_mac);
 
 	return 0;
 }
-- 
2.25.1

Re: [PATCH wireless-next 1/2] wifi: nxpwifi: protect sta_list against concurrent add and delete

[Jeff Chen]

On Fri, Aug 07, 2026 at 09:25:53 PM +0800, Linmao Li wrote:
> nxpwifi_del_sta_entry() unlinks an entry from priv->sta_list without
> holding priv->sta_list_spinlock.  The comment above it gives the
> reason: the function is only reached from cfg80211_ops.del_station,
> which runs under the wiphy mutex.

Thanks for the patch. 

Tested on nxpwifi with iw612 chipset.

Tested-by: Jeff Chen <jeff.chen_1@nxp.com>
Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com>

Re: [PATCH wireless-next 2/2] wifi: nxpwifi: delete the station entry on the uAP deauth event

[Jeff Chen]

On Fri, Aug 07, 2026 at 09:25:54 PM +0800, Linmao Li wrote:
> When a station leaves, the firmware reports EVENT_UAP_STA_DEAUTH.
> nxpwifi_uap_event_sta_deauth() tears down the reorder, BA and WMM state
> for that peer but leaves its nxpwifi_sta_node on priv->sta_list.
> 

Thanks for the patch.

Tested on nxpwifi with iw612 chipset.

Tested-by: Jeff Chen <jeff.chen_1@nxp.com>
Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com>