diff options
| author | Moon Hee Lee <moonhee.lee.ca@gmail.com> | 2025-07-16 02:09:05 +0300 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2025-07-18 15:11:27 +0300 |
| commit | 16ecdab5446f15a61ec88eb0d23d25d009821db0 (patch) | |
| tree | a392a6a79b63fd90e71d01d4148e276fbc848caa /include/uapi/linux | |
| parent | 81284e86bf8849f8e98e8ead3ff5811926b2107f (diff) | |
| download | linux-16ecdab5446f15a61ec88eb0d23d25d009821db0.tar.xz | |
wifi: mac80211: reject TDLS operations when station is not associated
syzbot triggered a WARN in ieee80211_tdls_oper() by sending
NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT,
before association completed and without prior TDLS setup.
This left internal state like sdata->u.mgd.tdls_peer uninitialized,
leading to a WARN_ON() in code paths that assumed it was valid.
Reject the operation early if not in station mode or not associated.
Reported-by: syzbot+f73f203f8c9b19037380@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f73f203f8c9b19037380
Fixes: 81dd2b882241 ("mac80211: move TDLS data to mgd private part")
Tested-by: syzbot+f73f203f8c9b19037380@syzkaller.appspotmail.com
Signed-off-by: Moon Hee Lee <moonhee.lee.ca@gmail.com>
Link: https://patch.msgid.link/20250715230904.661092-2-moonhee.lee.ca@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'include/uapi/linux')
0 files changed, 0 insertions, 0 deletions