mac80211: fix using smp_processor_id() in preemptible code in ieee80211_tx_control_port()

[PATCH] mac80211: fix using smp_processor_id() in preemptible code in ieee80211_tx_control_port()

Posted by Deepanshu Kartikey 2 weeks, 1 day ago

ieee80211_tx_control_port() can be called from nl80211_tx_control_port()
in normal process context via netlink sendmsg(), where BH/preemption
is not disabled. dev_sw_netstats_tx_add() uses this_cpu_ptr() internally,
which requires preemption to be disabled, triggering a
"BUG: using smp_processor_id() in preemptible code" warning.

Fix this by moving the local_bh_disable()/local_bh_enable() section to
also cover dev_sw_netstats_tx_add() and ieee80211_tpt_led_trig_tx().

Fixes: d5a014204a3b ("wifi: mac80211: tx: simplify control port frame transmission")
Reported-by: syzbot+d979bd35c8a76fd1b6f5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d979bd35c8a76fd1b6f5
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 net/mac80211/tx.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 74ab27534076..7b1a3c63e5dc 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -6687,10 +6687,9 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
 		return -EINVAL;
 	}
 
+	local_bh_disable();
 	dev_sw_netstats_tx_add(dev, 1, skb->len);
 	ieee80211_tpt_led_trig_tx(local, skb->len);
-
-	local_bh_disable();
 	ieee80211_xmit(sdata, sta, skb);
 	local_bh_enable();
 	rcu_read_unlock();
-- 
2.34.1

Re: [PATCH] mac80211: fix using smp_processor_id() in preemptible code in ieee80211_tx_control_port()

Posted by Deepanshu Kartikey 2 days, 13 hours ago

On Thu, Sep 10, 2026 at 9:40 AM Deepanshu Kartikey
<kartikey406@gmail.com> wrote:
>
> ieee80211_tx_control_port() can be called from nl80211_tx_control_port()
> in normal process context via netlink sendmsg(), where BH/preemption
> is not disabled. dev_sw_netstats_tx_add() uses this_cpu_ptr() internally,
> which requires preemption to be disabled, triggering a
> "BUG: using smp_processor_id() in preemptible code" warning.
>
> Fix this by moving the local_bh_disable()/local_bh_enable() section to
> also cover dev_sw_netstats_tx_add() and ieee80211_tpt_led_trig_tx().
>
> Fixes: d5a014204a3b ("wifi: mac80211: tx: simplify control port frame transmission")
> Reported-by: syzbot+d979bd35c8a76fd1b6f5@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=d979bd35c8a76fd1b6f5
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  net/mac80211/tx.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
> index 74ab27534076..7b1a3c63e5dc 100644
> --- a/net/mac80211/tx.c
> +++ b/net/mac80211/tx.c
> @@ -6687,10 +6687,9 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
>                 return -EINVAL;
>         }
>
> +       local_bh_disable();
>         dev_sw_netstats_tx_add(dev, 1, skb->len);
>         ieee80211_tpt_led_trig_tx(local, skb->len);
> -
> -       local_bh_disable();
>         ieee80211_xmit(sdata, sta, skb);
>         local_bh_enable();
>         rcu_read_unlock();
> --
> 2.34.1
>

Gentle Reminder. Please let me know the status of this patch.

Thanks

Deepanshu