From 0bdfb1a4697f94661b96b87893eddb56a5a102a5 Mon Sep 17 00:00:00 2001 From: Deepanshu Kartikey Date: Sat, 9 May 2026 06:16:28 +0530 Subject: [PATCH] wifi: mac80211_hwsim: reject NAN on multi-radio wiphys When userspace creates a new hwsim radio with both HWSIM_ATTR_MULTI_RADIO and HWSIM_ATTR_SUPPORT_NAN_DEVICE, hwsim_new_radio_nl() sets BIT(NL80211_IFTYPE_NAN_DATA) in wiphy->interface_modes while configuring the wiphy with n_radio > 1. This violates the invariant checked in wiphy_register(): (interface_modes & BIT(NL80211_IFTYPE_NAN_DATA)) && (!nan_capa.phy.ht.ht_supported || n_radio > 1) triggering a WARN reachable from userspace via genetlink. With panic_on_warn this becomes a denial of service. Refuse the combination at parse time with -EINVAL and an extack message, matching the cfg80211 constraint that NAN is not supported on multi-radio wiphys. Reported-by: syzbot+2002864e6c6895cb0ac3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2002864e6c6895cb0ac3 Fixes: 2c7c70ee7cee ("wifi: mac80211_hwsim: enable NAN_DATA interface simulation support") Tested-by: syzbot+2002864e6c6895cb0ac3@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey Link: https://patch.msgid.link/20260509004628.79446-1-kartikey406@gmail.com Signed-off-by: Johannes Berg --- drivers/net/wireless/virtual/mac80211_hwsim_main.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c index dc9775cd9f54..ec90da265b9e 100644 --- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c +++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c @@ -6766,9 +6766,15 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) param.p2p_device = true; } - if (param.nan_device) + if (param.nan_device) { + if (param.multi_radio) { + NL_SET_ERR_MSG(info->extack, + "NAN is not supported on multi-radio wiphys"); + return -EINVAL; + } param.iftypes |= BIT(NL80211_IFTYPE_NAN) | BIT(NL80211_IFTYPE_NAN_DATA); + } if (info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]) { u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);