From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sipsolutions.net (s3.sipsolutions.net [168.119.38.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 83EDE335546; Tue, 17 Feb 2026 12:05:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=168.119.38.16 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771329932; cv=none; b=Nz71Mbp6W0KgwfVm/KoNHzEdHqYKRXSMYA5N3+Ja1ON2g3LSnhDGraYXWxYiqu1D/i8q/gyt+5L1NWM9Ycm+1i2ZqfdRyZlxn3WOg2yS0mHzugtYkg5D7PuKzeN4up4FhbxE6AYF1P5b4fiuWWJmPziG/OdDusbQhdYN2/zCP2k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771329932; c=relaxed/simple; bh=9TbetKLdTQUsD/vRJOIgNGJWnMINoDf9BsPHItI5nQI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=QCax7SO8UJcMexL/UQ1e21FtWFyOv8sudZ+eialk/dQIVMOqWGlcpOw2Qt4CkCIAnFonOrEAk550iYhTb3BmLMQztAPZgM7DFVEC9Do24T3W5oVsL6qL7kpErf10SSz8WU8k69o8qIULTlNon/UxcCGBBbVugoI71UfxfTODa9A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sipsolutions.net; spf=pass smtp.mailfrom=sipsolutions.net; dkim=pass (2048-bit key) header.d=sipsolutions.net header.i=@sipsolutions.net header.b=abHOtGMh; arc=none smtp.client-ip=168.119.38.16 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sipsolutions.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sipsolutions.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=sipsolutions.net header.i=@sipsolutions.net header.b="abHOtGMh" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sipsolutions.net; s=mail; h=Content-Transfer-Encoding:MIME-Version: Message-ID:Date:Subject:Cc:To:From:Content-Type:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-To:Resent-Cc: Resent-Message-ID:In-Reply-To:References; bh=MztSQQkl/o/M+ckqgYetD692pugdb9K29mVA9oxdhfs=; t=1771329931; x=1772539531; b=abHOtGMhegbQD94XoiX9kn2W5HZj9iF5m3M59GGUfBVn+aY5ICyScDZxCQtpL7zEWAxrj27q6Tr wm/KCp2lUGv/8fSPJuZFZwDcwLmuIcpdWrH1sYH+3kR672e+RCJn5Aqye2Kcy8xdP6U8di60EPw6k xhlUx8xYQVII50VZWNuh58XbDXTcrylnvQ4bK+IeNdX7DC7aZgDR6ouXsca53QDFm1xniN6O/PvJw T7Pa7r687bmVsxqILX7ahJX3AQ2mBhCQgi92JchC2yCG+AnHy36cbYu6YCFl/3egVAAwDspquZq+U vLU+oz6aihfKnrDmwrdifihMovvSHnLp9MCw==; Received: by sipsolutions.net with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.98.2) (envelope-from ) id 1vsJpY-0000000BNek-2ufN; Tue, 17 Feb 2026 13:05:28 +0100 From: Johannes Berg To: linux-wireless@vger.kernel.org Cc: Johannes Berg , stable@vger.kernel.org, syzbot+b09c1af8764c0097bb19@syzkaller.appspotmail.com Subject: [PATCH wireless] wifi: radiotap: reject radiotap with unknown bits Date: Tue, 17 Feb 2026 13:05:26 +0100 Message-ID: <20260217120526.162647-2-johannes@sipsolutions.net> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Johannes Berg The radiotap parser is currently only used with the radiotap namespace (not with vendor namespaces), but if the undefined field 18 is used, the alignment/size is unknown as well. In this case, iterator->_next_ns_data isn't initialized (it's only set for skipping vendor namespaces), and syzbot points out that we later compare against this uninitialized value. Fix this by moving the rejection of unknown radiotap fields down to after the in-namespace lookup, so it will really use iterator->_next_ns_data only for vendor namespaces, even in case undefined fields are present. Cc: stable@vger.kernel.org Fixes: 33e5a2f776e3 ("wireless: update radiotap parser") Reported-by: syzbot+b09c1af8764c0097bb19@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/69944a91.a70a0220.2c38d7.00fc.GAE@google.com Signed-off-by: Johannes Berg --- net/wireless/radiotap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c index 326faea38ca3..c85eaa583a46 100644 --- a/net/wireless/radiotap.c +++ b/net/wireless/radiotap.c @@ -239,14 +239,14 @@ int ieee80211_radiotap_iterator_next( default: if (!iterator->current_namespace || iterator->_arg_index >= iterator->current_namespace->n_bits) { - if (iterator->current_namespace == &radiotap_ns) - return -ENOENT; align = 0; } else { align = iterator->current_namespace->align_size[iterator->_arg_index].align; size = iterator->current_namespace->align_size[iterator->_arg_index].size; } if (!align) { + if (iterator->current_namespace == &radiotap_ns) + return -ENOENT; /* skip all subsequent data */ iterator->_arg = iterator->_next_ns_data; /* give up on this namespace */ -- 2.53.0