]> git.ipfire.org Git - thirdparty/linux.git/commit
wifi: mac80211: avoid out-of-bounds access in monitor
authorMiri Korenblit <miriam.rachel.korenblit@intel.com>
Mon, 4 May 2026 07:20:46 +0000 (10:20 +0300)
committerJohannes Berg <johannes.berg@intel.com>
Tue, 5 May 2026 10:10:15 +0000 (12:10 +0200)
commit03c41203ee5a833a9d7a7630be190830cede29d8
tree60076c4a96827cf2aa76bbba47cba4f02ef36c66
parentad3d4d3d897f4013b4c050aa2b2aac27edd37420
wifi: mac80211: avoid out-of-bounds access in monitor

In NAN, we don't know on what band the frame will be sent. Therefore we
set info->band to NUM_NL80211_BANDS. However, this leads to out-of-bound
access in ieee80211_add_tx_radiotap_header when we try to access the
sbands array.

Fix it by not accessing the array if the band is NUM_NL80211_BANDS.
This means that we will not report rate info for legacy rate in NAN.
But nobody really cares about it.

Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260504101829.346c9893d136.I15919027597c04ec35c6217db6e52e2a605e5cfc@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/mac80211/status.c