]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
wifi: mac80211: reject TDLS operations when station is not associated
authorMoon Hee Lee <moonhee.lee.ca@gmail.com>
Tue, 15 Jul 2025 23:09:05 +0000 (16:09 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 15 Aug 2025 10:04:58 +0000 (12:04 +0200)
commit0c84204cf0bbe89e454a5caccc6a908bc7db1542
treea0edfc3e92a7ee267f0560f37b65b06f59054a2d
parentb88815ec43cc29a9aff3f623afad34357d6b4fd9
wifi: mac80211: reject TDLS operations when station is not associated

[ Upstream commit 16ecdab5446f15a61ec88eb0d23d25d009821db0 ]

syzbot triggered a WARN in ieee80211_tdls_oper() by sending
NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT,
before association completed and without prior TDLS setup.

This left internal state like sdata->u.mgd.tdls_peer uninitialized,
leading to a WARN_ON() in code paths that assumed it was valid.

Reject the operation early if not in station mode or not associated.

Reported-by: syzbot+f73f203f8c9b19037380@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f73f203f8c9b19037380
Fixes: 81dd2b882241 ("mac80211: move TDLS data to mgd private part")
Tested-by: syzbot+f73f203f8c9b19037380@syzkaller.appspotmail.com
Signed-off-by: Moon Hee Lee <moonhee.lee.ca@gmail.com>
Link: https://patch.msgid.link/20250715230904.661092-2-moonhee.lee.ca@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/mac80211/tdls.c