diff options
| author | Eduard Zateev <hackerowskiy@gmail.com> | 2026-10-07 16:28:55 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-10-09 16:07:57 +0200 |
| commit | 2531f6539d2f844f24fdfad6eea1361af68b3359 (patch) | |
| tree | f781c5e3fc6bf436a33b0c7ee8af7704c966d027 /net/wireless | |
| parent | 45f9960f8cf33a9f6b44bf4ae2a0dad393b5f8ea (diff) | |
wifi: cfg80211: validate WEXT station BSSID
WEXT IBSS and managed mode store the BSSID in the same
wdev->wext.bssid buffer. cfg80211_ibss_wext_siwap() keeps a pointer to
that buffer in wext.ibss.bssid. After changing to station mode,
cfg80211_mgd_wext_siwap() accepts a multicast AP address and copies it
to the buffer. Switching back to IBSS then follows that pointer and
uses the multicast address as a fixed BSSID.
mac80211 can create a beacon with that address, but cfg80211_get_bss()
rejects it, causing WARN_ON(!bss) in cfg80211_ibss_joined() after the
join has been reported.
Reject invalid station BSSIDs before copying them. A mac80211_hwsim WEXT
ioctl test reproduces the reported BSSID and warning; the original
syzbot report has no reproducer.
Reported-by: syzbot+d0a52209bddfa0948065@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=d0a52209bddfa0948065
Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>
Link: https://patch.msgid.link/20261007142855.1472524-1-hackerowskiy@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/wext-sme.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c index b5914f3658db..3db73a0765c9 100644 --- a/net/wireless/wext-sme.c +++ b/net/wireless/wext-sme.c @@ -245,6 +245,9 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev, if (is_zero_ether_addr(bssid) || is_broadcast_ether_addr(bssid)) bssid = NULL; + if (bssid && !is_valid_ether_addr(bssid)) + return -EINVAL; + if (wdev->conn) { /* both automatic */ if (!bssid && !wdev->wext.connect.bssid) |