From nobody Tue Sep 29 05:34:51 2026 Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 583BF478E47 for ; Tue, 11 Aug 2026 21:12:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786482762; cv=none; b=ZK7nYmRvtLbmTT1498I/20Fk8zofn4Hij2qMQUgsGDATBWqMltVJp2AfvuoC9ZCvoGbKy16Vb4LpLue3IppzwIjpHoScnbLUUvOK7sXXZJytzaD6i3hRlBcxl44xXMzIdUveFF7QMaYqnCHik15FAivgogyAZMn/suir3t0sais= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786482762; c=relaxed/simple; bh=5X0Fq06kgVt3Zfxy9oWgweoQ7Qb3HoyJt8LOKfYjkkk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=PuOUm3FwQ8ibjh/gNVrHouywU0thj0RS7te44jxMED6JPeSzJl5ERI0P/TCxhxybvoeeVknsJK7LA5PT7XoZo02zzQ8TWWAD2s2hZrh8W5DqU1YgqWp89cwtebXIwvGMMSZXioxGJvcb1ZQPSTDuWsGeYRjoL+DaOgZVBW/kv3g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BRQDZYk0; arc=none smtp.client-ip=209.85.215.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BRQDZYk0" Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-cbe6295f05bso1157922a12.1 for ; Tue, 11 Aug 2026 14:12:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786482761; x=1787087561; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=bfCgYj603awFHVan+OL9MOSp/Yr+4rdiabbgO1A0ubw=; b=BRQDZYk0yOLTr3GeHwcBU52Xarb6aGKrxcc4Z3h5XG/jhqKC5r4i4gyGBcBqPTanBm efeqmIeY2aylR/fdcbNE+qTKoO8SFjQkbMdENvZYDhbWALK7RlxCJOF7VgWWnGHCB9Dt hUWxyol/16xrWKvsr3iR37LwHaI1Q4Fb6FVnT2+IoDRHuoia25kjMQtoEsE1VhLPziAQ fB6D3KuRbRExXkxNK7XktKxYHoPIUvLl7z60ynHZWf22iB7ZI+cbgD7PIYKFReN2FDzG 06CGzYmsCsU8ooMqSiQYLM7N7zCPwiw6kbuwAMNKr3yMD61S38hSnwjvEAAfJXBMV77v M2ew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786482761; x=1787087561; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bfCgYj603awFHVan+OL9MOSp/Yr+4rdiabbgO1A0ubw=; b=mrb3jqCFBI4TGqO8AZKmEVrS5jsN0lNP5xJ4GnFdGtRjL+1nf7Led2v0HSePs2LluL /N7w0ALSOmf9hbFto6/aYiCEHxes7FBMx6FIBVJHqZkdAsbs49aGiEpbLKhXGjWg5ZvW 3UttR+YcCTcxFi0p4f4yJ6EEb+8IO442WfPU3MmUWEfd+gOByWCnsmC5UloiUfkPX3Ar qa8V1QsVnDn7j5i6HMbEafJpbFTmLsn5hkKMSTXLi+Uvi4cIfO2Lb+Hnx3C+SJNWrc4n GMSeZGMNoJ+unyOjI72tAzR9j1W2AiuAiJsi8mV0xMu7dB1JxQ8CWnJzZCPGIOgDhRC0 G2dw== X-Forwarded-Encrypted: i=1; AHgh+RpPgfsotun/HcrbEUlRvjChToEUcwBU87AhyPK84NfsVQqGZVrS8nt3ha4DBjhIOzCgp9imtNnBb+OEEYA=@vger.kernel.org X-Gm-Message-State: AOJu0YxmzTXINrIEhT71yDuy2+onMj429oBpk0xkFhCGKyjrbzivx8cf gSY0fXewLAI+2me3LSixylw1Do1PiT0Eu1uaW6AtbvOe9zwS3u993sZK X-Gm-Gg: AR+sD10SrCAuHMXj46yHUlPoiRQcaVR2fVC7qAVE+4pj9uQapEICXfIesk0VxG4Hjxc bUYWGNyTmvsi8Evm9cO3RZJ9/kFofY82F6r3bYnYSvFcmvGmJmRmX6nKZKUIvSWuYon3TCabgxq LfMs4sf0oRDc71sXxpCuLRJPQoi9KCfFs/56fCOfKjVI+sVl8zVh38zIYY/E+lxTpvNGGHFWcbM lFC4hlxhlhhWeBlRKTaOIRJ/fhHXG8a4jkaslTTphq525TM0TvQsWLKDp2Dj9aRC2vx3cJ1pLW+ KRG1VlFi6u1o/J0vxPFWlNiaJojd3PQxnJZRJQIrzgP9w7qD28tWJWc1eX3XTPRg982il/ZU+1n 5rWAjVM80+U4Sr9YATO8hW4b49mVL6TRfjcSrjb8Di3mvXPafGd+YEX6al82Co8jOvMFlaRgsaX kwQerSIpzslL9qwcww4GXCkCTe76GiAFNR/nZV85YSQ37zITWpJl2o+c3IGd/adKrBa65wnbHLT 5zgasq01p07f/CiFkpFVQ8Dra7OPrScngEd+fdfPBwy6l+AMDAeMJq1OLnL2foJWMzuI4/ovN+c x+7J X-Received: by 2002:a05:6a20:72a8:b0:3bf:8a0e:dd99 with SMTP id adf61e73a8af0-3cc37a386d2mr2886514637.17.1786482760462; Tue, 11 Aug 2026 14:12:40 -0700 (PDT) Received: from nixos ([2405:201:c40d:9039:4f8b:4d:f8c2:8f50]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31cf3624c6dsm4004869eec.4.2026.08.11.14.12.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Aug 2026 14:12:39 -0700 (PDT) From: Ayushman Rout To: johannes@sipsolutions.net Cc: nbd@nbd.name, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Ayushman Rout , syzbot+f1ba58d6b55abd13239e@syzkaller.appspotmail.com Subject: [PATCH] wifi: mac80211: guard drv_net_setup_tc() against unbound AP_VLAN sdata Date: Wed, 12 Aug 2026 02:39:26 +0530 Message-ID: <20260811210926.11422-1-ayushmanrout27@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" syzbot reports a NULL/invalid pointer dereference in trace_event_raw_event_drv_net_setup_tc(), reached via ieee80211_netdev_setup_tc() -> drv_net_setup_tc(). drv_net_setup_tc() calls get_bss_sdata(sdata) unconditionally. For an NL80211_IFTYPE_AP_VLAN interface this does container_of(sdata->bss, ...), but sdata->bss is only linked opportunistically at interface-add time when a matching same-address AP interface exists - it is not enforced, so an AP_VLAN interface can be fully created and registered with sdata->bss left NULL. container_of() on NULL yields a small invalid pointer rather than NULL, which the trace_drv_net_setup_tc tracepoint then dereferences to read the interface name. Guard against an unbound AP_VLAN sdata before calling get_bss_sdata(), matching the WARN_ON_ONCE(!bss) precondition already used for this same relationship in sta_info.c. Also add check_sdata_in_driver(), used by the neighboring drv_net_fill_forward_path() but missing here. The underlying gap in ieee80211_if_add() - AP_VLAN creation not requiring a bound bss - is not fixed here; other get_bss_sdata() callers may share the exposure. Fixes: 61587f1556fe ("wifi: mac80211: add support for letting drivers regis= ter tc offload support") Reported-by: syzbot+f1ba58d6b55abd13239e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Df1ba58d6b55abd13239e Signed-off-by: Ayushman Rout --- net/mac80211/driver-ops.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h index f1c0b87fddd5..ecfdb51152f4 100644 --- a/net/mac80211/driver-ops.h +++ b/net/mac80211/driver-ops.h @@ -1702,7 +1702,23 @@ static inline int drv_net_setup_tc(struct ieee80211_= local *local, =20 might_sleep(); =20 + /* + * An AP_VLAN interface created without a matching, same-address + * AP interface present never gets sdata->bss populated (see the + * interface-add validation in iface.c, which links bss only + * opportunistically and does not require it). Such an sdata is + * not safe to pass through get_bss_sdata(): container_of() on a + * NULL sdata->bss yields a small invalid pointer, which the + * tracepoint below then dereferences to read the interface name, + * causing a crash. + */ + if (sdata->vif.type =3D=3D NL80211_IFTYPE_AP_VLAN && !sdata->bss) + return -EIO; + sdata =3D get_bss_sdata(sdata); + if (!check_sdata_in_driver(sdata)) + return -EIO; + trace_drv_net_setup_tc(local, sdata, type); if (local->ops->net_setup_tc) ret =3D local->ops->net_setup_tc(&local->hw, &sdata->vif, dev, --=20 2.54.0