[Midnightbsd-cvs] [MidnightBSD/src] 9d8ae8: linuxkpi: 80211: release BSS node outside the LHW ...

[Lucas Holt]

  Branch: refs/heads/fix-iwlwifi-lkpi80211-assoc-panic
  Home:   https://github.com/MidnightBSD/src
  Commit: 9d8ae81aa4a3b2307035c27b166f2903c90c0ccd
      https://github.com/MidnightBSD/src/commit/9d8ae81aa4a3b2307035c27b166f2903c90c0ccd
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-26 (Fri, 26 Jun 2026)

  Changed paths:
    M sys/compat/linuxkpi/common/src/linux_80211.c

  Log Message:
  -----------
  linuxkpi: 80211: release BSS node outside the LHW lock on teardown

Backport from FreeBSD stable/14.  In the STA teardown handlers the final
ieee80211_free_node() for the lvif_bss node was called while holding the
LHW lock.  net80211's node_free path can drain the per-sta txq taskqueue
(which takes the same LHW lock) and, where HW crypto is enabled, delete
keys via the same path -- a deadlock / recurse-on-non-recursive-sx
hazard.  Move the free past the unlock, guarded so it only runs on the
same paths that previously freed (success for auth_to_scan; the EALREADY
full-teardown path for _lkpi_sta_assoc_to_down and run_to_init).

Fixes the three teardown handlers:
- lkpi_sta_auth_to_scan      (free on error == 0)
- _lkpi_sta_assoc_to_down    (free on error == EALREADY)
- lkpi_sta_run_to_init       (free on error == EALREADY)

Builds clean (-Werror).

Obtained from:	FreeBSD (stable/14)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply at anthropic.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications