wifi: mac80211: fix NULL pointer dereference in ieee80211_mesh_build_beacon()

[PATCH] wifi: mac80211: fix NULL pointer dereference in ieee80211_mesh_build_beacon()

Posted by Jeongjun Park 2 weeks, 5 days ago

NULL pointer dereference bug occurs because ieee80211_mesh_build_beacon()
does not check the return value of ieee80211_get_sband().

Therefore, we need to add a return value check to prevent this.

Reported-by: syzbot+81cd9dc1596563141d19@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/696e34bf.a70a0220.34546f.04ad.GAE@google.com/
Fixes: 147ceae20534 ("wifi: mac80211: simplify adding supported rates")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
---
 net/mac80211/mesh.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 68901f1def0d..eb3a346226bd 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -964,6 +964,8 @@ ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
 	sdata = container_of(ifmsh, struct ieee80211_sub_if_data, u.mesh);
 
 	sband = ieee80211_get_sband(sdata);
+	if (!sband)
+		return -EINVAL;
 
 	ie_len_he_cap = ieee80211_ie_len_he_cap(sdata);
 	ie_len_eht_cap = ieee80211_ie_len_eht_cap(sdata);
--

Re: [PATCH] wifi: mac80211: fix NULL pointer dereference in ieee80211_mesh_build_beacon()

Posted by Johannes Berg 2 weeks, 4 days ago

On Tue, 2026-01-20 at 00:00 +0900, Jeongjun Park wrote:
> NULL pointer dereference bug occurs because ieee80211_mesh_build_beacon()
> does not check the return value of ieee80211_get_sband().
> 
> Therefore, we need to add a return value check to prevent this.

No we don't, please try to understand the code, and why it can even get
here when the mesh interface isn't operating.

johannes