github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: mac80211_hwsim: reject NAN on multi-radio wiphys

Browse Source 
When userspace creates a new hwsim radio with both
HWSIM_ATTR_MULTI_RADIO and HWSIM_ATTR_SUPPORT_NAN_DEVICE,
hwsim_new_radio_nl() sets BIT(NL80211_IFTYPE_NAN_DATA) in
wiphy->interface_modes while configuring the wiphy with
n_radio > 1. This violates the invariant checked in
wiphy_register():

    (interface_modes & BIT(NL80211_IFTYPE_NAN_DATA)) &&
    (!nan_capa.phy.ht.ht_supported || n_radio > 1)

triggering a WARN reachable from userspace via genetlink.
With panic_on_warn this becomes a denial of service.

Refuse the combination at parse time with -EINVAL and an
extack message, matching the cfg80211 constraint that NAN
is not supported on multi-radio wiphys.

Reported-by: syzbot+2002864e6c6895cb0ac3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2002864e6c6895cb0ac3
Fixes: 2c7c70ee7c ("wifi: mac80211_hwsim: enable NAN_DATA interface simulation support")
Tested-by: syzbot+2002864e6c6895cb0ac3@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Link: https://patch.msgid.link/20260509004628.79446-1-kartikey406@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Deepanshu Kartikey 2026-05-09 06:16:28 +05:30 committed by Johannes Berg
parent 9ca605426b
commit 0bdfb1a469
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/net/wireless/virtual/mac80211_hwsim_main.c
View File

@ -6766,9 +6766,15 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
param.p2p_device = true;
}
if (param.nan_device)
if (param.nan_device) {
if (param.multi_radio) {
NL_SET_ERR_MSG(info->extack,
"NAN is not supported on multi-radio wiphys");
return -EINVAL;
}
param.iftypes |= BIT(NL80211_IFTYPE_NAN) |
BIT(NL80211_IFTYPE_NAN_DATA);
}
if (info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]) {
u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);