wifi: nl80211: check link is beaconing for color change

When trying to do a color change, validate that the link is
beaconing first, to avoid calling the driver with an invalid
link.

Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260415145348.beb59ea5fbf7.I128a956a3e610bb6a5c9cad941d7d5b59b735a5e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index f9727303ad4bdf5dc43426a96c3d05a87063b7b8..b870456623fb3cd6fc19ddaa68a464fac4dafe9e 100644 (file)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -18388,6 +18388,10 @@ static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
        params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
        params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
 
+       params.link_id = nl80211_link_id(info->attrs);
+       if (!wdev->links[params.link_id].ap.beacon_interval)
+               return -EINVAL;
+
        err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_next,
                                   wdev->links[params.link_id].ap.chandef.chan,
                                   info->extack);
@@ -18463,7 +18467,6 @@ static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
                        goto out;
        }
 
-       params.link_id = nl80211_link_id(info->attrs);
        err = rdev_color_change(rdev, dev, &params);
 
 out: