diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2026-09-08 14:28:13 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-09-09 14:51:30 +0200 |
| commit | 4504f3960dc4501c73be9f99eabda2e26e9db41e (patch) | |
| tree | ed2127aef8d2a7e444b82733574926186a26ae36 | |
| parent | e14bf37bb2b3853012ff160131d1c6233f7a9cc9 (diff) | |
| download | linux-next-4504f3960dc4501c73be9f99eabda2e26e9db41e.tar.gz linux-next-4504f3960dc4501c73be9f99eabda2e26e9db41e.zip | |
wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
On ifup, AP_VLAN interfaces get crypto_tx_tailroom_needed_cnt from
the AP interface, but it's never decremented again unless the AP is
also brought down. Thus, bringing the same AP_VLAN up again will
increment the counter again and eventually hit the sanity check:
WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt !=
master->crypto_tx_tailroom_needed_cnt);
Reset it on ifdown to avoid that.
Assisted-by: LLM
Fixes: f9dca80b98ca ("mac80211: fix AP_VLAN crypto tailroom calculation")
Reported-by: syzbot+de3ee5362db09487ea37@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=de3ee5362db09487ea37
Link: https://patch.msgid.link/20260908122838.201719-14-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/mac80211/iface.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index ca66eb493ac7..889c32fd8de1 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -616,6 +616,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do RCU_INIT_POINTER(sdata->vif.bss_conf.chanctx_conf, NULL); /* see comment in the default case below */ ieee80211_free_keys(sdata, true); + /* increased by AP value on ifup, so reset on ifdown */ + sdata->crypto_tx_tailroom_needed_cnt = 0; /* no need to tell driver */ break; case NL80211_IFTYPE_MONITOR: |