For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] wifi: mac80211: fix WARN_ON_ONCE in ieee80211_tdls_oper
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
NL80211_TDLS_ENABLE_LINK can be called without completing the TDLS
setup handshake, or after the TDLS_PEER_SETUP_TIMEOUT (15 seconds)
has expired and tdls_peer_del_work has zeroed out the peer address.
In both cases the WARN_ON_ONCE triggers because tdls_peer is either
zero or mismatched with the requested peer.
Replace the WARN_ON_ONCE with a proper check that returns -ENOLINK
to enforce that ENABLE_LINK can only proceed after a successful TDLS
handshake.
Reported-by: syzbot+56b6a844a4ea74487b7b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=56b6a844a4ea74487b7b
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
net/mac80211/tdls.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index dbbfe2d6842f..d7d8b2fcc3ee 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -1457,8 +1457,9 @@ int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
set_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
- WARN_ON_ONCE(is_zero_ether_addr(sdata->u.mgd.tdls_peer) ||
- !ether_addr_equal(sdata->u.mgd.tdls_peer, peer));
+ if (is_zero_ether_addr(sdata->u.mgd.tdls_peer) ||
+ !ether_addr_equal(sdata->u.mgd.tdls_peer, peer))
+ return -ENOLINK;
break;
case NL80211_TDLS_DISABLE_LINK:
/*
--
2.43.0