diff options
| author | Moon Hee Lee <moonhee.lee.ca@gmail.com> | 2025-07-15 16:09:05 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-08-15 16:38:49 +0200 |
| commit | 31af06b574394530f68a4310c45ecbe2f68853c4 (patch) | |
| tree | 41b5fb6807a5c528a54d97eef3d871225ade93f5 | |
| parent | 71cf65ab462d3e4aa3c17c6d34a8e33a15d7cca0 (diff) | |
wifi: mac80211: reject TDLS operations when station is not associated
[ Upstream commit 16ecdab5446f15a61ec88eb0d23d25d009821db0 ]
syzbot triggered a WARN in ieee80211_tdls_oper() by sending
NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT,
before association completed and without prior TDLS setup.
This left internal state like sdata->u.mgd.tdls_peer uninitialized,
leading to a WARN_ON() in code paths that assumed it was valid.
Reject the operation early if not in station mode or not associated.
Reported-by: syzbot+f73f203f8c9b19037380@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f73f203f8c9b19037380
Fixes: 81dd2b882241 ("mac80211: move TDLS data to mgd private part")
Tested-by: syzbot+f73f203f8c9b19037380@syzkaller.appspotmail.com
Signed-off-by: Moon Hee Lee <moonhee.lee.ca@gmail.com>
Link: https://patch.msgid.link/20250715230904.661092-2-moonhee.lee.ca@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/mac80211/tdls.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c index 94714f8ffd22..ba5fbacbeeda 100644 --- a/net/mac80211/tdls.c +++ b/net/mac80211/tdls.c @@ -1422,7 +1422,7 @@ int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev, if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)) return -EOPNOTSUPP; - if (sdata->vif.type != NL80211_IFTYPE_STATION) + if (sdata->vif.type != NL80211_IFTYPE_STATION || !sdata->vif.cfg.assoc) return -EINVAL; switch (oper) { |