From a919316bbb700d44baf9cdbf78666bce24261bc8 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 13 Oct 2026 15:13:29 +0200 Subject: [PATCH] wifi: mac80211: tests: fix stack variable bug The code in mac80211 assumes that BSS entries are allocated together with the struct ieee80211_bss internal data, but the test didn't do that, which with clang 23 resulted in a KASAN splat here. Fix the code to properly have both structs. Fix the allocation while at it, should be the ies struct size, not the cbss. Link: https://patch.msgid.link/20261013151329.b8135eb40430.I97a6cb689fbc19903c78e2f6dfe37bdc2117b605@changeid Signed-off-by: Johannes Berg --- net/mac80211/tests/chan-mode.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/net/mac80211/tests/chan-mode.c b/net/mac80211/tests/chan-mode.c index 85dc87215d23..d6714df8a5c6 100644 --- a/net/mac80211/tests/chan-mode.c +++ b/net/mac80211/tests/chan-mode.c @@ -153,8 +153,11 @@ static void test_determine_chan_mode(struct kunit *test) .mode = params->conn_mode, .bw_limit = params->conn_bw_limit, }; - struct cfg80211_bss cbss = { - .channel = &t_sdata->band_5ghz.channels[0], + struct { + struct cfg80211_bss cbss; + struct ieee80211_bss internal; + } bss = { + .cbss.channel = &t_sdata->band_5ghz.channels[0], }; unsigned long userspace_selectors[BITS_TO_LONGS(128)] = {}; u8 bss_ies[] = { @@ -229,18 +232,18 @@ static void test_determine_chan_mode(struct kunit *test) if (params->userspace_selector) set_bit(params->userspace_selector, userspace_selectors); - rcu_assign_pointer(cbss.ies, + rcu_assign_pointer(bss.cbss.ies, kunit_kzalloc(test, - sizeof(cbss) + sizeof(bss_ies), + sizeof(*bss.cbss.ies) + sizeof(bss_ies), GFP_KERNEL)); - KUNIT_ASSERT_NOT_NULL(test, rcu_access_pointer(cbss.ies)); - ((struct cfg80211_bss_ies *)rcu_access_pointer(cbss.ies))->len = sizeof(bss_ies); + KUNIT_ASSERT_NOT_NULL(test, rcu_access_pointer(bss.cbss.ies)); + ((struct cfg80211_bss_ies *)rcu_access_pointer(bss.cbss.ies))->len = sizeof(bss_ies); - memcpy((void *)rcu_access_pointer(cbss.ies)->data, bss_ies, + memcpy((void *)rcu_access_pointer(bss.cbss.ies)->data, bss_ies, sizeof(bss_ies)); rcu_read_lock(); - elems = ieee80211_determine_chan_mode(t_sdata->sdata, &conn, &cbss, + elems = ieee80211_determine_chan_mode(t_sdata->sdata, &conn, &bss.cbss, NULL, 0, &chanreq, &ap_chandef, userspace_selectors); rcu_read_unlock();