diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2026-09-04 16:55:01 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-09-08 13:09:38 +0200 |
| commit | a7783e585360ee05dfe21d3173dbbe985c94f29e (patch) | |
| tree | bdbc1254b9749e0da80c2a33e3850041f5196411 | |
| parent | ad7265b29995ff12b2ce834a6a6162d616462362 (diff) | |
| download | linux-next-a7783e585360ee05dfe21d3173dbbe985c94f29e.tar.gz linux-next-a7783e585360ee05dfe21d3173dbbe985c94f29e.zip | |
wifi: cfg80211: don't get the radio mask for netdev-less wdevs
cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with
wdev->netdev, which can be NULL and then crashes in mac80211.
To avoid that, invert the order of checks since wdev->netdev
is always valid for beaconing interfaces.
Assisted-by: LLM
Fixes: abb4cfe3661a ("wifi: cfg80211: extend interface combination check for multi-radio")
Reported-by: syzbot+abff43d2d045e37c0bb2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=abff43d2d045e37c0bb2
Link: https://patch.msgid.link/20260904165614.2056a8b7dc91.I7412c5062d8166ad6c81ee7252cec49dea19a60f@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/wireless/util.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/net/wireless/util.c b/net/wireless/util.c index 3e584d0ca3e2..408ebb10924f 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -2477,16 +2477,15 @@ static void cfg80211_calculate_bi_data(struct wiphy *wiphy, u32 new_beacon_int, if (wdev->valid_links) continue; + wdev_bi = cfg80211_wdev_bi(wdev); + if (!wdev_bi) + continue; + /* skip wdevs not active on the given wiphy radio */ if (radio_idx >= 0 && !(rdev_get_radio_mask(rdev, wdev->netdev) & BIT(radio_idx))) continue; - wdev_bi = cfg80211_wdev_bi(wdev); - - if (!wdev_bi) - continue; - if (!*beacon_int_gcd) { *beacon_int_gcd = wdev_bi; continue; |