kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/net/mac80211
History
Vahagn Vardanian cc6d5a3c0a wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() 
commit 017c179252 upstream.

In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced
at lines 1638 and 1642 without a prior NULL check:

    ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl;
    ...
    pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value);

The mesh_matches_local() check above only validates the Mesh ID,
Mesh Configuration, and Supported Rates IEs.  It does not verify the
presence of the Mesh Channel Switch Parameters IE (element ID 118).
When a received CSA action frame omits that IE, ieee802_11_parse_elems()
leaves elems->mesh_chansw_params_ie as NULL, and the unconditional
dereference causes a kernel NULL pointer dereference.

A remote mesh peer with an established peer link (PLINK_ESTAB) can
trigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame
that includes a matching Mesh ID and Mesh Configuration IE but omits the
Mesh Channel Switch Parameters IE.  No authentication beyond the default
open mesh peering is required.

Crash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  Oops: Oops: 0000 [#1] SMP NOPTI
  RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211]
  CR2: 0000000000000000

Fix by adding a NULL check for mesh_chansw_params_ie after
mesh_matches_local() returns, consistent with how other optional IEs
are guarded throughout the mesh code.

The bug has been present since v3.13 (released 2014-01-19).

Fixes: 8f2535b92d ("mac80211: process the CSA frame for mesh accordingly")
Cc: stable@vger.kernel.org
Signed-off-by: Vahagn Vardanian <vahagn@redrays.io>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-03-12 07:09:39 -04:00
..
tests Plenty of things going on, notably: 2025-09-11 17:50:46 -07:00
aead_api.c mac80211: Check crypto_aead_encrypt for errors 2021-03-16 21:20:41 +01:00
aead_api.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aes_ccm.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aes_cmac.c wifi: mac80211: fix CMAC functions not handling errors 2025-12-18 14:03:06 +01:00
aes_cmac.h wifi: mac80211: fix CMAC functions not handling errors 2025-12-18 14:03:06 +01:00
aes_gcm.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
aes_gmac.c mac80211: Check crypto_aead_encrypt for errors 2021-03-16 21:20:41 +01:00
aes_gmac.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
agg-rx.c wifi: mac80211: add support for S1G aggregation 2025-06-24 15:19:28 +02:00
agg-tx.c wifi: mac80211: add support for S1G aggregation 2025-06-24 15:19:28 +02:00
airtime.c wifi: mac80211: introduce EHT rate support in AQL airtime 2024-09-06 12:58:36 +02:00
cfg.c wifi: mac80211: do not use old MBSSID elements 2026-01-08 10:16:42 +01:00
chan.c wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work 2025-10-28 14:56:42 +01:00
debug.h wifi: mac80211: don't WARN for late channel/color switch 2025-06-17 14:30:06 +02:00
debugfs.c wifi: mac80211: remove tx_handlers_drop debugfs stats 2025-09-19 11:50:48 +02:00
debugfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
debugfs_key.c wifi: mac80211: Clean up debugfs_key deadcode 2025-01-13 13:51:19 +01:00
debugfs_key.h wifi: mac80211: Clean up debugfs_key deadcode 2025-01-13 13:51:19 +01:00
debugfs_netdev.c wifi: mac80211: Remove redundant rcu_read_lock/unlock() in spin_lock 2025-09-19 11:48:14 +02:00
debugfs_netdev.h wifi: mac80211: fix driver debugfs for vif type change 2024-02-02 13:09:55 +01:00
debugfs_sta.c wifi: mac80211: Remove redundant rcu_read_lock/unlock() in spin_lock 2025-09-19 11:48:14 +02:00
debugfs_sta.h wifi: mac80211: add API to show the link STAs in debugfs 2022-10-07 15:23:41 +02:00
driver-ops.c wifi: mac80211: don't send keys to driver when fips_enabled 2025-07-15 11:00:38 +02:00
driver-ops.h wifi: mac80211: fix incorrect type for ret 2025-08-26 13:46:48 +02:00
drop.h wifi: mac80211: Drop cooked monitor support 2025-02-11 11:58:17 +01:00
eht.c wifi: mac80211: fix MPDU length parsing for EHT 5/6 GHz 2025-03-12 09:29:14 +01:00
ethtool.c wifi: mac80211: add tx_handlers_drop statistics to ethtool 2025-09-10 15:04:27 +02:00
fils_aead.c wifi: mac80211: Do not include crypto/algapi.h 2023-08-24 08:42:36 +02:00
fils_aead.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
he.c wifi: mac80211: add some support for RX OMI power saving 2025-01-13 15:26:43 +01:00
ht.c wifi: mac80211: handle WLAN_HT_ACTION_NOTIFY_CHANWIDTH async 2025-07-15 11:00:39 +02:00
ibss.c wifi: mac80211: add support towards MLO handling of station statistics 2025-06-24 15:19:26 +02:00
ieee80211_i.h wifi: mac80211: apply advertised TTLM from association response 2026-02-06 16:57:34 +01:00
iface.c wifi: mac80211: correctly check if CSA is active 2026-02-11 13:41:53 +01:00
Kconfig mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING 2024-10-08 21:14:57 +02:00
key.c wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice 2026-02-11 13:41:53 +01:00
key.h wifi: mac80211: remove key_mtx 2023-09-11 11:27:22 +02:00
led.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
led.h leds: Change led_trigger_blink[_oneshot]() delay parameters to pass-by-value 2023-05-25 12:16:27 +01:00
link.c wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work 2025-10-28 14:56:42 +01:00
main.c wifi: mac80211: correctly initialise S1G chandef for STA 2025-09-19 11:56:07 +02:00
Makefile wifi: mac80211: move element parsing to a new file 2024-02-08 15:00:43 +01:00
mesh.c wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() 2026-03-12 07:09:39 -04:00
mesh.h wifi: mac80211: split mesh fast tx cache into local/proxied/forwarded 2024-04-17 09:21:32 +02:00
mesh_hwmp.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
mesh_pathtbl.c wifi: mac80211: Replace __get_unaligned_cpu32 in mesh_pathtbl.c 2025-04-23 15:28:50 +02:00
mesh_plink.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
mesh_ps.c wifi: mac80211: support parsing S1G TIM PVB 2025-09-04 11:19:01 +02:00
mesh_sync.c wifi: mac80211, cfg80211: miscellaneous spelling fixes 2024-10-08 21:52:09 +02:00
michael.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
michael.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
mlme.c wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration 2026-03-12 07:09:39 -04:00
ocb.c wifi: mac80211: ocb: skip rx_no_sta when interface is not joined 2026-02-11 13:41:46 +01:00
offchannel.c wifi: mac80211: Support Tx of action frame for NAN 2025-09-19 11:26:22 +02:00
parse.c wifi: mac80211: fix non-transmitted BSSID profile search 2025-07-07 10:42:48 +02:00
pm.c wifi: cfg80211/mac80211: Add support to get radio index 2025-06-24 15:19:27 +02:00
rate.c wifi: mac80211: Support Tx of action frame for NAN 2025-09-19 11:26:22 +02:00
rate.h wifi: mac80211: convert debugfs files to short fops 2024-10-23 16:47:07 +02:00
rc80211_minstrel_ht.c wifi: cfg80211/mac80211: remove more 5/10 MHz code 2025-04-23 15:21:32 +02:00
rc80211_minstrel_ht.h wifi: mac80211: minstrel_ht: remove unused has_mrr member from struct minstrel_priv 2022-10-07 15:25:05 +02:00
rc80211_minstrel_ht_debugfs.c [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
rx.c wifi: mac80211: Discard Beacon frames to non-broadcast address 2026-01-08 10:17:12 +01:00
s1g.c wifi: mac80211: handle station association response with S1G 2025-06-24 15:19:28 +02:00
scan.c wifi: mac80211: don't perform DA check on S1G beacon 2026-01-30 10:32:13 +01:00
spectmgmt.c wifi: mac80211: Avoid -Wflex-array-member-not-at-end warnings 2025-04-23 15:20:20 +02:00
sta_info.c wifi: mac80211: collect station statistics earlier when disconnect 2026-02-11 13:41:50 +01:00
sta_info.h wifi: mac80211: add support to accumulate removed link statistics 2025-06-24 15:19:26 +02:00
status.c wifi: mac80211: Get the correct interface for non-netdev skb status 2025-09-19 11:26:23 +02:00
tdls.c wifi: mac80211: reject TDLS operations when station is not associated 2025-07-18 14:11:27 +02:00
tkip.c Merge net-next/main to resolve conflicts 2024-10-09 08:59:22 +02:00
tkip.h Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
trace.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
trace.h wifi: cfg80211/mac80211: Add support to get radio index 2025-06-24 15:19:27 +02:00
trace_msg.h wifi: mac80211: remove unused MAX_MSG_LEN define 2024-02-08 12:50:09 +01:00
tx.c wifi: mac80211: restore non-chanctx injection behaviour 2026-01-17 16:35:15 +01:00
util.c wifi: mac80211: correctly initialise S1G chandef for STA 2025-09-19 11:56:07 +02:00
vht.c wifi: mac80211: make VHT opmode NSS ignore a debug message 2025-07-15 10:59:11 +02:00
wbrf.c wifi: mac80211: use cfg80211_chandef_get_width() 2025-03-12 09:50:27 +01:00
wep.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
wep.h mac80211: make ieee80211_wep_init() return void 2020-02-07 12:40:34 +01:00
wme.c wifi: mac80211: fix qos on mesh interfaces 2023-03-22 13:46:38 +01:00
wme.h wifi: mac80211: Drop support for TX push path 2022-10-10 11:06:14 +02:00
wpa.c wifi: mac80211: fix CMAC functions not handling errors 2025-12-18 14:03:06 +01:00
wpa.h wifi: mac80211: remove cipher scheme support 2022-06-10 15:35:53 +02:00