wifi: mac80211: Fix a kernel panic in ieee80211_encrypt_tx_skb()

skb->dev may be NULL for frames on non-netdev devices. For example, NAN
device frames after pairing. Fix it.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260504072055.1292999-2-miriam.rachel.korenblit@intel.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index c18de2cb3769a95bf2353d779866ad4e9760226d..933c86ca21c385e41d7d29dcfeb6d72f824aa024 100644 (file)
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -5355,7 +5355,7 @@ static int ieee80211_beacon_protect(struct sk_buff *skb,
 int ieee80211_encrypt_tx_skb(struct sk_buff *skb)
 {
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-       struct ieee80211_sub_if_data *sdata;
+       struct ieee80211_sub_if_data *sdata = NULL;
        struct sk_buff *check_skb;
        struct ieee80211_tx_data tx;
        ieee80211_tx_result res;
@@ -5370,7 +5370,14 @@ int ieee80211_encrypt_tx_skb(struct sk_buff *skb)
        __skb_queue_head_init(&tx.skbs);
        __skb_queue_tail(&tx.skbs, skb);
 
-       sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
+       if (skb->dev)
+               sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
+       else if (info->control.vif)
+               sdata = vif_to_sdata(info->control.vif);
+
+       if (WARN_ON(!sdata))
+               return -EINVAL;
+
        tx.sdata = sdata;
        tx.local = sdata->local;
        res = ieee80211_tx_h_encrypt(&tx);