From: Andrei Otcheretianski Date: Mon, 4 May 2026 07:20:45 +0000 (+0300) Subject: wifi: mac80211: Fix a kernel panic in ieee80211_encrypt_tx_skb() X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ad3d4d3d897f4013b4c050aa2b2aac27edd37420;p=thirdparty%2Flinux.git wifi: mac80211: Fix a kernel panic in ieee80211_encrypt_tx_skb() skb->dev may be NULL for frames on non-netdev devices. For example, NAN device frames after pairing. Fix it. Signed-off-by: Andrei Otcheretianski Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260504072055.1292999-2-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg --- diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index c18de2cb3769..933c86ca21c3 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -5355,7 +5355,7 @@ static int ieee80211_beacon_protect(struct sk_buff *skb, int ieee80211_encrypt_tx_skb(struct sk_buff *skb) { struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); - struct ieee80211_sub_if_data *sdata; + struct ieee80211_sub_if_data *sdata = NULL; struct sk_buff *check_skb; struct ieee80211_tx_data tx; ieee80211_tx_result res; @@ -5370,7 +5370,14 @@ int ieee80211_encrypt_tx_skb(struct sk_buff *skb) __skb_queue_head_init(&tx.skbs); __skb_queue_tail(&tx.skbs, skb); - sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev); + if (skb->dev) + sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev); + else if (info->control.vif) + sdata = vif_to_sdata(info->control.vif); + + if (WARN_ON(!sdata)) + return -EINVAL; + tx.sdata = sdata; tx.local = sdata->local; res = ieee80211_tx_h_encrypt(&tx);