Skip to content

Commit dc14686

Browse files
Carrtikjmberg-intel
authored andcommitted
wifi: cfg80211: wext: validate chandef in monitor mode
cfg80211_wext_siwfreq() constructs a channel definition for monitor mode but passes it to cfg80211_set_monitor_channel() without first validating it with cfg80211_chandef_valid(). This causes a WARN_ON in cfg80211_chandef_dfs_required() when it receives an invalid chandef. Add the missing cfg80211_chandef_valid() check before calling cfg80211_set_monitor_channel() to return -EINVAL early on invalid channel definitions, consistent with how other callers handle this. Reported-by: syzbot+02a1a03b8622d3c7d1c9@syzkaller.appspotmail.com Signed-off-by: Kartik Nair <contact.kartikn@gmail.com> Link: https://patch.msgid.link/20260510202437.7857-1-contact.kartikn@gmail.com [clarify subject] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1 parent 8499d09 commit dc14686

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

net/wireless/wext-compat.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -789,6 +789,8 @@ static int cfg80211_wext_siwfreq(struct net_device *dev,
789789
chandef.chan = ieee80211_get_channel(&rdev->wiphy, freq);
790790
if (!chandef.chan)
791791
return -EINVAL;
792+
if (!cfg80211_chandef_valid(&chandef))
793+
return -EINVAL;
792794
return cfg80211_set_monitor_channel(rdev, dev, &chandef);
793795
case NL80211_IFTYPE_MESH_POINT:
794796
freq = cfg80211_wext_freq(wextfreq);

0 commit comments

Comments
 (0)