From: Ping-Ke Shih Date: Wed, 6 May 2026 13:10:00 +0000 (+0800) Subject: wifi: rtw89: check skb headroom before adding radiotap X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f77199a0cf6660d45d72010e76c3ab4788e9da5f;p=thirdparty%2Fkernel%2Flinux.git wifi: rtw89: check skb headroom before adding radiotap The radiotap headroom is allocated only if IEEE80211_CONF_MONITOR is set. However, it is potentially racing that SKB allocation without radiotap headroom but adding radiotap from matched PPDU status of another SKB. Add a check to avoid the case. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260506131000.1706298-15-pkshih@realtek.com --- diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index c21737981b616..432d46dfd26a6 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -3758,6 +3758,13 @@ static void rtw89_core_update_radiotap(struct rtw89_dev *rtwdev, if (!(rtwdev->hw->conf.flags & IEEE80211_CONF_MONITOR)) return; + /* + * At transient adding a monitor vif from a station vif, the headroom + * might not include radiotap. + */ + if (unlikely(skb_headroom(skb) < RTW89_RADIOTAP_ROOM + NET_SKB_PAD)) + return; + if (rx_status->encoding == RX_ENC_VHT) rtw89_core_update_radiotap_vht(rtwdev, skb, rx_status, phy_ppdu); else if (rx_status->encoding == RX_ENC_HE)