diff options
| author | Kartik Nair <contact.kartikn@gmail.com> | 2026-05-11 01:54:37 +0530 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-05-20 11:44:19 +0200 |
| commit | dc14686f27df6454b13b16ad1c9203ab3e9b0375 (patch) | |
| tree | ecc8cb214bc513a6c97855a58380596748f89caf /net/wireless | |
| parent | 8499d0949d6a624b830d66d480f98badbf24dc26 (diff) | |
| download | linux-next-dc14686f27df6454b13b16ad1c9203ab3e9b0375.tar.gz linux-next-dc14686f27df6454b13b16ad1c9203ab3e9b0375.zip | |
wifi: cfg80211: wext: validate chandef in monitor mode
cfg80211_wext_siwfreq() constructs a channel definition for monitor
mode but passes it to cfg80211_set_monitor_channel() without first
validating it with cfg80211_chandef_valid(). This causes a WARN_ON
in cfg80211_chandef_dfs_required() when it receives an invalid chandef.
Add the missing cfg80211_chandef_valid() check before calling
cfg80211_set_monitor_channel() to return -EINVAL early on invalid
channel definitions, consistent with how other callers handle this.
Reported-by: syzbot+02a1a03b8622d3c7d1c9@syzkaller.appspotmail.com
Signed-off-by: Kartik Nair <contact.kartikn@gmail.com>
Link: https://patch.msgid.link/20260510202437.7857-1-contact.kartikn@gmail.com
[clarify subject]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/wext-compat.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c index 22d9d9bae8f5..63d145b524c9 100644 --- a/net/wireless/wext-compat.c +++ b/net/wireless/wext-compat.c @@ -789,6 +789,8 @@ static int cfg80211_wext_siwfreq(struct net_device *dev, chandef.chan = ieee80211_get_channel(&rdev->wiphy, freq); if (!chandef.chan) return -EINVAL; + if (!cfg80211_chandef_valid(&chandef)) + return -EINVAL; return cfg80211_set_monitor_channel(rdev, dev, &chandef); case NL80211_IFTYPE_MESH_POINT: freq = cfg80211_wext_freq(wextfreq); |