kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/net/mac80211
History
Mikhail Lobanov 3bcb702977 wifi: mac80211: check basic rates validity in sta_link_apply_parameters 
commit 16ee3ea8fa upstream.

When userspace sets supported rates for a new station via
NL80211_CMD_NEW_STATION, it might send a list that's empty
or contains only invalid values. Currently, we process these
values in sta_link_apply_parameters() without checking the result of
ieee80211_parse_bitrates(), which can lead to an empty rates bitmap.

A similar issue was addressed for NL80211_CMD_SET_BSS in commit
ce04abc3fc ("wifi: mac80211: check basic rates validity").
This patch applies the same approach in sta_link_apply_parameters()
for NL80211_CMD_NEW_STATION, ensuring there is at least one valid
rate by inspecting the result of ieee80211_parse_bitrates().

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Fixes: b95eb7f0ee ("wifi: cfg80211/mac80211: separate link params from station params")
Signed-off-by: Mikhail Lobanov <m.lobanov@rosa.ru>
Link: https://patch.msgid.link/20250317103139.17625-1-m.lobanov@rosa.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[ Summary of conflict resolutions:
  - The function ieee80211_parse_bitrates() takes channel width as
    its first parameter, and the chandef struct has been refactored
    in kernel version 6.9, in commit
    6092077ad0 so that the width is
    contained in chanreq.oper.width. In kernel version 6.1 the
    width parameter is defined directly in the chandef struct. ]
Signed-off-by: Hanne-Lotta Mäenpää <hannelotta@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-08-28 16:26:16 +02:00
..
aead_api.c mac80211: Check crypto_aead_encrypt for errors 2021-03-16 21:20:41 +01:00
aead_api.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aes_ccm.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aes_cmac.c mac80211: aes_cmac: check crypto_shash_setkey() return value 2021-04-19 12:01:40 +02:00
aes_cmac.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aes_gcm.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aes_gmac.c mac80211: Check crypto_aead_encrypt for errors 2021-03-16 21:20:41 +01:00
aes_gmac.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
agg-rx.c wifi: mac80211: fix multi-BSSID element parsing 2022-07-15 11:43:17 +02:00
agg-tx.c wifi: mac80211: fix NULL dereference at band check in starting tx ba session 2024-11-08 16:26:48 +01:00
airtime.c wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration 2022-11-25 12:45:53 +01:00
cfg.c wifi: mac80211: check basic rates validity in sta_link_apply_parameters 2025-08-28 16:26:16 +02:00
chan.c wifi: mac80211: update radar_required in channel context after channel switch 2025-08-28 16:25:57 +02:00
debug.h wifi: mac80211: debug: omit link if non-MLO connection 2022-07-15 11:43:14 +02:00
debugfs.c wifi: mac80211: optionally implement MLO multicast TX 2022-07-22 14:28:36 +02:00
debugfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
debugfs_key.c wifi: mac80211: reorg some iface data structs for MLD 2022-06-20 12:55:06 +02:00
debugfs_key.h mac80211: Support BIGTK configuration for Beacon protection 2020-02-24 10:35:57 +01:00
debugfs_netdev.c wifi: mac80211: prohibit deactivating all links 2025-02-21 13:49:03 +01:00
debugfs_netdev.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
debugfs_sta.c wifi: mac80211: Proper mark iTXQs for resumption 2023-02-01 08:34:35 +01:00
debugfs_sta.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
driver-ops.c wifi: mac80211: fix BA session teardown race 2024-08-29 17:30:28 +02:00
driver-ops.h wifi: mac80211: Proper mark iTXQs for resumption 2023-02-01 08:34:35 +01:00
eht.c wifi: cfg80211/mac80211: check EHT capability size correctly 2022-08-25 10:41:24 +02:00
ethtool.c wifi: mac80211: read ethtool's sta_stats from sinfo 2022-08-26 09:56:54 +02:00
fils_aead.c mac80211: fils: use cfg80211_find_ext_elem() 2021-10-21 17:01:16 +02:00
fils_aead.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
he.c wifi: mac80211: correctly parse Spatial Reuse Parameter Set element 2024-06-21 14:35:32 +02:00
ht.c wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap 2024-01-20 11:50:03 +01:00
ibss.c wifi: mac80211: work around Cisco AP 9115 VHT MPDU length 2023-10-25 12:03:10 +02:00
ieee80211_i.h wifi: mac80211: export ieee80211_purge_tx_queue() for drivers 2025-05-02 07:46:55 +02:00
iface.c wifi: mac80211: Purge vif txq in ieee80211_do_stop() 2025-04-25 10:43:47 +02:00
Kconfig mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING 2024-11-08 16:26:40 +01:00
key.c wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys 2024-11-08 16:26:40 +01:00
key.h wifi: mac80211: implement link switching 2022-09-06 10:17:20 +02:00
led.c mac80211: don't open-code LED manipulations 2021-06-23 11:29:12 +02:00
led.h mac80211: fix throughput LED trigger 2021-11-15 10:56:57 +01:00
link.c wifi: mac80211: fix link activation settings order 2023-06-21 16:00:59 +02:00
main.c mac80211: fix user-power when emulating chanctx 2024-12-14 19:53:08 +01:00
Makefile wifi: mac80211: move link code to a new file 2022-09-03 17:02:25 +02:00
mesh.c wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata 2024-07-25 09:49:09 +02:00
mesh.h mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh 2022-01-04 15:11:49 +01:00
mesh_hwmp.c wifi: mac80211: do not offer a mesh path if forwarding is disabled 2025-06-27 11:07:34 +01:00
mesh_pathtbl.c wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects 2024-06-21 14:35:31 +02:00
mesh_plink.c wifi: mac80211: mesh_plink: fix matches_local logic 2024-01-01 12:38:54 +00:00
mesh_ps.c mac80211: mesh: fix potentially unaligned access 2021-09-23 13:25:09 +02:00
mesh_sync.c mac80211: mesh: clean up rx_bcn_presp API 2021-09-23 16:26:33 +02:00
michael.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
michael.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
mlme.c wifi: mac80211: don't complete management TX on SAE commit 2025-08-28 16:25:56 +02:00
ocb.c wifi: mac80211: fix up link station creation/insertion 2022-07-15 11:43:23 +02:00
offchannel.c wifi: mac80211: don't use rate mask for offchannel TX either 2024-10-17 15:20:38 +02:00
pm.c mac80211: Prevent AP probing during suspend 2021-10-21 17:27:51 +02:00
rate.c wifi: mac80211: don't use rate mask for offchannel TX either 2024-10-17 15:20:38 +02:00
rate.h wifi: mac80211: make ieee80211_check_rate_mask() link-aware 2022-07-15 11:43:21 +02:00
rc80211_minstrel_ht.c treewide: use get_random_bytes() when possible 2022-10-11 17:42:58 -06:00
rc80211_minstrel_ht.h mac80211: minstrel_ht: support ieee80211_rate_status 2022-05-16 10:07:58 +02:00
rc80211_minstrel_ht_debugfs.c mac80211: minstrel_ht: show sampling rates in debugfs 2021-02-12 08:58:11 +01:00
rx.c wifi: mac80211: drop invalid source address OCB frames 2025-07-10 15:59:50 +02:00
s1g.c wifi: mac80211: Set TWT Information Frame Disabled bit as 1 2022-11-02 09:50:40 +01:00
scan.c Revert "wifi: mac80211: fix RCU list iterations" 2024-11-14 13:15:17 +01:00
spectmgmt.c wifi: mac80211: separate out connection downgrade flags 2022-07-15 11:43:14 +02:00
sta_info.c wifi: mac80211: avoid lockdep checking when removing deflink 2025-08-28 16:26:16 +02:00
sta_info.h wifi: mac80211: add documentation for amsdu_mesh_control 2024-08-29 17:30:54 +02:00
status.c wifi: mac80211: export ieee80211_purge_tx_queue() for drivers 2025-05-02 07:46:55 +02:00
tdls.c wifi: mac80211: reject TDLS operations when station is not associated 2025-08-15 12:04:58 +02:00
tkip.c mac80211: Fix TKIP replay protection immediately after key setup 2020-01-15 09:52:12 +01:00
tkip.h Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
trace.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
trace.h wifi: mac80211: fix min center freq offset tracing 2023-05-24 17:32:46 +01:00
trace_msg.h mac80211: tracing: Use the new __vstring() helper 2022-07-24 19:11:17 -04:00
tx.c Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" 2025-08-15 12:04:59 +02:00
util.c wifi: mac80211: fix beacon interval calculation overflow 2025-07-06 10:58:00 +02:00
vht.c wifi: mac80211: track capability/opmode NSS separately 2024-08-03 08:49:46 +02:00
wep.c mac80211: make ieee80211_wep_init() return void 2020-02-07 12:40:34 +01:00
wep.h mac80211: make ieee80211_wep_init() return void 2020-02-07 12:40:34 +01:00
wme.c wifi: mac80211: fix qos on mesh interfaces 2023-03-30 12:49:27 +02:00
wme.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wpa.c wifi: use struct_group to copy addresses 2022-09-03 16:40:06 +02:00
wpa.h wifi: mac80211: remove cipher scheme support 2022-06-10 15:35:53 +02:00