From nobody Mon Sep 28 11:39:40 2026 Received: from azure-sdnproxy.icoremail.net (azure-sdnproxy.icoremail.net [207.46.229.174]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 23F7A2DCC1F; Sat, 22 Aug 2026 02:22:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=207.46.229.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787365357; cv=none; b=urg3wE+lBj9vLlFzBNtusGMjrWnN5IwOpAzPHQ6CI6lHydAWhGIguFAfE7amjbF2zQAxFqQiz7Sobn/dgqupr2zJTUFSyD0KjGFZD1c0NHeTaZIdAr/HLjbAwyibNadV2Z6+jWctXLBWGFKUQ87qUk9F8MkPCE0C4kQdMOcnMng= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787365357; c=relaxed/simple; bh=CR99sBFnfcKm4yMIDsuuo1j7lrWy5d+CVFupD7dEqOI=; h=Date:From:To:Cc:Subject:Content-Type:MIME-Version:Message-ID; b=sfpY494oQzuiLRWjX7XvwSpLfNKjMvBHMNS862oxH2RDE3K/5OZJEKpJXNjOMqQeAbpBEcieHiLH9Ynyd4aAqCQE8LCbSqXSQQUhwfNE3SUL3QroI7y/leWNNKDNfxpnl4/VCXSzGRhf6bl8zbEXIEE0CSCT9ueo0QhU0uB+c8w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn; spf=pass smtp.mailfrom=zju.edu.cn; arc=none smtp.client-ip=207.46.229.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zju.edu.cn Received: from zju.edu.cn (unknown [10.190.161.59]) by mtasvr (Coremail) with SMTP id _____wA3TnzdB4lqgBW0AA--.17784S3; Sat, 22 Aug 2026 10:22:22 +0800 (CST) Received: from stitch$zju.edu.cn ( [10.190.161.59] ) by ajax-webmail-mail-app4 (Coremail) ; Sat, 22 Aug 2026 10:22:21 +0800 (GMT+08:00) Date: Sat, 22 Aug 2026 10:22:21 +0800 (GMT+08:00) X-CM-HeaderCharset: UTF-8 From: "Jiacheng Xu" To: "Johannes Berg" Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net] wifi: cfg80211: reject invalid bss_entries_limit X-Priority: 3 X-Mailer: Coremail Webmail Server Version 2025.3-cmXT6 build 20260617(6f868824) Copyright (c) 2002-2026 www.mailtech.cn zju.edu.cn Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <718c70a4.17a06.1a02746bac2.Coremail.stitch@zju.edu.cn> X-Coremail-Locale: zh_CN X-CM-TRANSID: zi_KCgCnRy7dB4lqO1JcAw--.26385W X-CM-SenderInfo: qtrxiiaqttimo62m3hxhgxhubq/1tbiAwQLC2qJAhcAZQAAsU X-CM-DELIVERINFO: =?B?hZxuHgXKKxbFmtjJiESix3B1w3tMoM3snk/k5SVzZVydjEqe1eefKHnLf95EnB4iem egWx2b1XQTgwOlnfv+ZLCYlNQvCvOZN3tuMY8DEumdj9dUA4jX6JQSDpVfY/P0MxSwJuBE YpAc1E4D3pqFM8kbj7cS6PToom5tWv95HmQKsM367KouAWbe58T/3nze79iaiA== X-Coremail-Antispam: 1Uk129KBj93XoW7Aw4xJFyrWrW3uF17Ar4DWrX_yoW8uF18pF Wxury5tr4kKF17AwsYyr4Skr9Yq3y8Cr47WFyaq3ZYvw4fGr1fZF1xKr4Yvr17C34kXwn8 tF47tFyDKw4jyacCm3ZEXasCq-sJn29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7KY7ZEXa sCq-sGcSsGvfJ3Ic02F40EFcxC0VAKzVAqx4xG6I80ebIjqfuFe4nvWSU5nxnvy29KBjDU 0xBIdaVrnRJUUUPlb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I20VC2zVCF04k26cxKx2 IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48v e4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI 0_Cr1j6rxdM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I8E87Iv6xkF7I0E14v2 6rxl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l57IF6xkI12xvs2x26I8E6xACxx1l5I 8CrVACY4xI64kE6c02F40Ex7xfMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AK xVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41lF7xvr2IYc2Ij64 vIr40E4x8a64kEw24lFcxC0VAYjxAxZF0Ew4CEw7xC0wACY4xI67k04243AVC20s07MxAI w28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr 4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUXVWUAwCIc40Y0x0EwIxG rwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVWUJVW8Jw CI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2 z280aVCY1x0267AKxVWUJVW8JwCE64xvF2IEb7IF0Fy7YxBIdaVFxhVjvjDU0xZFpf9x07 jeXd8UUUUU= Content-Type: text/plain; charset="utf-8" The writable cfg80211.bss_entries_limit module parameter is currently parsed by the generic integer parameter setter, which accepts zero and negative values. When bss_entries_limit is set to zero, the first new BSS entry satisfies: rdev->bss_entries >=3D bss_entries_limit This causes __cfg80211_bss_update() to call cfg80211_bss_expire_oldest() while the BSS list has no eligible entry. The resulting NULL oldest entry triggers WARN_ON(!oldest). Add a custom parameter setter that preserves normal integer parsing but rejects values below one. Register it with module_param_call(), while preserving the original getter, permissions, compile-time type checking, and module parameter type metadata. Update the parameter description to document the minimum value. Fixes: 9853a55ef1bb ("cfg80211: limit scan results cache size") Cc: stable@vger.kernel.org Signed-off-by: Jiacheng Xu --- net/wireless/scan.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 071083cc3367..a14acc699dc4 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -71,9 +71,27 @@ * entries in total, so overhead is bigger.) */ static int bss_entries_limit =3D 1000; -module_param(bss_entries_limit, int, 0644); + +static int bss_entries_limit_set(const char *val, + const struct kernel_param *kp) +{ + int limit, ret; + + ret =3D kstrtoint(val, 0, &limit); + if (ret) + return ret; + if (limit < 1) + return -EINVAL; + + return param_set_int(val, kp); +} + +param_check_int(bss_entries_limit, &bss_entries_limit); +module_param_call(bss_entries_limit, bss_entries_limit_set, + param_get_int, &bss_entries_limit, 0644); +__MODULE_PARM_TYPE(bss_entries_limit, "int"); MODULE_PARM_DESC(bss_entries_limit, - "limit to number of scan BSS entries (per wiphy, default 1000)"); + "limit to number of scan BSS entries (per wiphy, default 100= 0, minimum 1)"); #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ)