wifi: rtw89: check skb headroom before adding radiotap

The radiotap headroom is allocated only if IEEE80211_CONF_MONITOR is set.
However, it is potentially racing that SKB allocation without radiotap
headroom but adding radiotap from matched PPDU status of another SKB.
Add a check to avoid the case.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260506131000.1706298-15-pkshih@realtek.com

diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index c21737981b616cd6b67f143adbafc29e99b27fdd..432d46dfd26a61a65e20eb5a9ca7877aefa7f94a 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -3758,6 +3758,13 @@ static void rtw89_core_update_radiotap(struct rtw89_dev *rtwdev,
        if (!(rtwdev->hw->conf.flags & IEEE80211_CONF_MONITOR))
                return;
 
+       /*
+        * At transient adding a monitor vif from a station vif, the headroom
+        * might not include radiotap.
+        */
+       if (unlikely(skb_headroom(skb) < RTW89_RADIOTAP_ROOM + NET_SKB_PAD))
+               return;
+
        if (rx_status->encoding == RX_ENC_VHT)
                rtw89_core_update_radiotap_vht(rtwdev, skb, rx_status, phy_ppdu);
        else if (rx_status->encoding == RX_ENC_HE)