ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() and normally
freed in ieee80211_mesh_finish_csa() once the channel switch
completes. If the mesh interface is stopped while a channel switch
is still in progress, ifmsh->csa is never freed, leaking the
mesh_csa_settings object.

Free it in ieee80211_stop_mesh(), the same way ifmsh->beacon is
already handled there.

Reported-by: syzbot+f5752cd6b94fe38be666@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f5752cd6b94fe38be666
Tested-by: syzbot+f5752cd6b94fe38be666@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 net/mac80211/mesh.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index d4507e4e6ec1..d3fb4478a366 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1201,7 +1201,8 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
 	struct ieee80211_local *local = sdata->local;
 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 	struct beacon_data *bcn;
-
+	struct mesh_csa_settings *csa;
+
 	netif_carrier_off(sdata->dev);
 
 	/* flush STAs and mpaths on this iface */
@@ -1222,6 +1223,13 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
 	RCU_INIT_POINTER(ifmsh->beacon, NULL);
 	kfree_rcu(bcn, rcu_head);
 
+	/* free any pending, unfinished channel switch */
+	csa = sdata_dereference(ifmsh->csa, sdata);
+	if (csa) {
+		RCU_INIT_POINTER(ifmsh->csa, NULL);
+		kfree_rcu(csa, rcu_head);
+	}
+
 	/* free all potentially still buffered group-addressed frames */
 	local->total_ps_buffered -= skb_queue_len(&ifmsh->ps.bc_buf);
 	skb_queue_purge(&ifmsh->ps.bc_buf);
-- 
2.34.1

On Mon Aug 24, 2026 at 7:46 AM CEST, Deepanshu Kartikey wrote:
> ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() and normally
> freed in ieee80211_mesh_finish_csa() once the channel switch
> completes. If the mesh interface is stopped while a channel switch
> is still in progress, ifmsh->csa is never freed, leaking the
> mesh_csa_settings object.
>
> Free it in ieee80211_stop_mesh(), the same way ifmsh->beacon is
> already handled there.
>
> Reported-by: syzbot+f5752cd6b94fe38be666@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=f5752cd6b94fe38be666
> Tested-by: syzbot+f5752cd6b94fe38be666@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  net/mac80211/mesh.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
> index d4507e4e6ec1..d3fb4478a366 100644
> --- a/net/mac80211/mesh.c
> +++ b/net/mac80211/mesh.c
> @@ -1201,7 +1201,8 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
>  	struct ieee80211_local *local = sdata->local;
>  	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
>  	struct beacon_data *bcn;
> -
> +	struct mesh_csa_settings *csa;
> +
>  	netif_carrier_off(sdata->dev);
>  
>  	/* flush STAs and mpaths on this iface */
> @@ -1222,6 +1223,13 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
>  	RCU_INIT_POINTER(ifmsh->beacon, NULL);
>  	kfree_rcu(bcn, rcu_head);
>  
> +	/* free any pending, unfinished channel switch */
> +	csa = sdata_dereference(ifmsh->csa, sdata);
> +	if (csa) {
> +		RCU_INIT_POINTER(ifmsh->csa, NULL);
> +		kfree_rcu(csa, rcu_head);
> +	}
> +
Why not really handling it like the beacon data and just remove the if ?

	csa = sdata_dereference(ifmsh->csa, sdata);
	RCU_INIT_POINTER(ifmsh->csa, NULL);
	kfree_rcu(csa, rcu_head);

Should do the same:
	- RCU_INIT_POINTER() will not take too much time
	- kfree_rcu() already does a null check

>  	/* free all potentially still buffered group-addressed frames */
>  	local->total_ps_buffered -= skb_queue_len(&ifmsh->ps.bc_buf);
>  	skb_queue_purge(&ifmsh->ps.bc_buf);

Thanks

On Mon, Aug 24, 2026 at 9:57 PM Nicolas Escande <nico.escande@gmail.com> wrote:
>

> Why not really handling it like the beacon data and just remove the if ?
>
>         csa = sdata_dereference(ifmsh->csa, sdata);
>         RCU_INIT_POINTER(ifmsh->csa, NULL);
>         kfree_rcu(csa, rcu_head);
>
> Should do the same:
>         - RCU_INIT_POINTER() will not take too much time
>         - kfree_rcu() already does a null check
>
> >       /* free all potentially still buffered group-addressed frames */
> >       local->total_ps_buffered -= skb_queue_len(&ifmsh->ps.bc_buf);
> >       skb_queue_purge(&ifmsh->ps.bc_buf);
>
> Thanks

I will send patch v2.

Thanks

Deepanshu