From 9d1365e96a920bf79974161e370b5640a0054461 Mon Sep 17 00:00:00 2001 From: Mariano Baragiola Date: Mon, 17 Aug 2026 20:35:21 -0300 Subject: [PATCH] wifi: mac80211: avoid trimming injected FCS twice When packet sockets use PACKET_QDISC_BYPASS, mac80211 can parse the radiotap header while selecting the queue and again before transmit. If the header includes an FCS, both parses trim the skb. Validate the FCS on both parses, but trim it only before transmit. This keeps queue selection read-only and avoids trimming shared skb data twice. Fixes: cb17ed29a7a5 ("mac80211: parse radiotap header when selecting Tx queue") Signed-off-by: Mariano Baragiola Link: https://patch.msgid.link/20260817233521.2747027-1-mbaragiola@linux.com Signed-off-by: Johannes Berg --- include/net/mac80211.h | 3 ++- net/mac80211/iface.c | 2 +- net/mac80211/tx.c | 7 ++++--- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/include/net/mac80211.h b/include/net/mac80211.h index f147bc019e7b..7bb4618065b6 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -7630,11 +7630,12 @@ bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw, * * @skb: packet injected by userspace * @dev: the &struct device of this 802.11 device + * @trim_fcs: trim the FCS trailer when present; validate it otherwise * * Return: %true if the radiotap header was parsed, %false otherwise */ bool ieee80211_parse_tx_radiotap(struct sk_buff *skb, - struct net_device *dev); + struct net_device *dev, bool trim_fcs); /** * struct ieee80211_noa_data - holds temporary data for tracking P2P NoA state diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index 43460a705a6b..fdac729ca580 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -964,7 +964,7 @@ static u16 ieee80211_monitor_select_queue(struct net_device *dev, /* reset flags and info before parsing radiotap header */ memset(info, 0, sizeof(*info)); - if (!ieee80211_parse_tx_radiotap(skb, dev)) + if (!ieee80211_parse_tx_radiotap(skb, dev, false)) return 0; /* doesn't matter, frame will be dropped */ len_rthdr = ieee80211_get_radiotap_len(skb->data); diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 7d34b160fddd..c33092960df2 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -2138,7 +2138,7 @@ static bool ieee80211_validate_radiotap_len(struct sk_buff *skb) } bool ieee80211_parse_tx_radiotap(struct sk_buff *skb, - struct net_device *dev) + struct net_device *dev, bool trim_fcs) { struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr); struct ieee80211_radiotap_iterator iterator; @@ -2195,7 +2195,8 @@ bool ieee80211_parse_tx_radiotap(struct sk_buff *skb, if (skb->len < (iterator._max_length + FCS_LEN)) return false; - skb_trim(skb, skb->len - FCS_LEN); + if (trim_fcs) + skb_trim(skb, skb->len - FCS_LEN); } if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP) info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT; @@ -2511,7 +2512,7 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb, * selected chandef above to accurately set injection rates and * retransmissions. */ - if (!ieee80211_parse_tx_radiotap(skb, dev)) + if (!ieee80211_parse_tx_radiotap(skb, dev, true)) goto fail_rcu; /* remove the injection radiotap header */