wifi: mac80211_hwsim: reject NAN on multi-radio wiphys

When userspace creates a new hwsim radio with both
HWSIM_ATTR_MULTI_RADIO and HWSIM_ATTR_SUPPORT_NAN_DEVICE,
hwsim_new_radio_nl() sets BIT(NL80211_IFTYPE_NAN_DATA) in
wiphy->interface_modes while configuring the wiphy with
n_radio > 1. This violates the invariant checked in
wiphy_register():

    (interface_modes & BIT(NL80211_IFTYPE_NAN_DATA)) &&
    (!nan_capa.phy.ht.ht_supported || n_radio > 1)

triggering a WARN reachable from userspace via genetlink.
With panic_on_warn this becomes a denial of service.

Refuse the combination at parse time with -EINVAL and an
extack message, matching the cfg80211 constraint that NAN
is not supported on multi-radio wiphys.

Reported-by: syzbot+2002864e6c6895cb0ac3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2002864e6c6895cb0ac3
Fixes: 2c7c70ee7cee ("wifi: mac80211_hwsim: enable NAN_DATA interface simulation support")
Tested-by: syzbot+2002864e6c6895cb0ac3@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Link: https://patch.msgid.link/20260509004628.79446-1-kartikey406@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
index dc9775cd9f5406dce129ddd2c687e5eefb06de21..ec90da265b9ea1b43211e8a4b278710869de5142 100644 (file)
--- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
@@ -6766,9 +6766,15 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
                param.p2p_device = true;
        }
 
-       if (param.nan_device)
+       if (param.nan_device) {
+               if (param.multi_radio) {
+                       NL_SET_ERR_MSG(info->extack,
+                                      "NAN is not supported on multi-radio wiphys");
+                       return -EINVAL;
+               }
                param.iftypes |= BIT(NL80211_IFTYPE_NAN) |
                                 BIT(NL80211_IFTYPE_NAN_DATA);
+       }
 
        if (info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]) {
                u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);