[PATCH] wifi: cfg80211: enforce HE/EHT cap/oper consistency

[PATCH] wifi: cfg80211: enforce HE/EHT cap/oper consistency

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

Xiang Mei reports that mac80211 could crash if eht_cap is set
but eht_oper isn't. Rather than fixing that for the individual
user(s), enforce that both HE/EHT have consistent elements.

Reported-by: Xiang Mei <xmei5@asu.edu>
Fixes: 22c64f37e1d4 ("wifi: mac80211: Update MCS15 support in link_conf")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/wireless/nl80211.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index dac2e8643c49..76c537a6e8b5 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -6714,6 +6714,12 @@ static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
 			return -EINVAL;
 	}
 
+	if (!!params->he_cap != !!params->he_oper)
+		return -EINVAL;
+
+	if (!!params->eht_cap != !!params->eht_oper)
+		return -EINVAL;
+
 	return 0;
 }
 
-- 
2.53.0

Re: [PATCH] wifi: cfg80211: enforce HE/EHT cap/oper consistency

[kernel test robot]

Hi Johannes,

kernel test robot noticed the following build errors:

[auto build test ERROR on wireless-next/main]
[also build test ERROR on wireless/main linus/master v7.1-rc6 next-20260602]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Johannes-Berg/wifi-cfg80211-enforce-HE-EHT-cap-oper-consistency/20260603-173706
base:   https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main
patch link:    https://lore.kernel.org/r/20260603091812.101894-2-johannes%40sipsolutions.net
patch subject: [PATCH] wifi: cfg80211: enforce HE/EHT cap/oper consistency
config: x86_64-kexec (https://download.01.org/0day-ci/archive/20260603/202606031815.lqRk4eKB-lkp@intel.com/config)
compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project f43d6834093b19baf79beda8c0337ab020ac5f17)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260603/202606031815.lqRk4eKB-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202606031815.lqRk4eKB-lkp@intel.com/

All errors (new ones prefixed by >>):

>> net/wireless/nl80211.c:12054:8: error: use of undeclared identifier 'params'
    12054 |         if (!!params->he_cap != !!params->he_oper)
          |               ^~~~~~
   net/wireless/nl80211.c:12054:28: error: use of undeclared identifier 'params'
    12054 |         if (!!params->he_cap != !!params->he_oper)
          |                                   ^~~~~~
   net/wireless/nl80211.c:12057:8: error: use of undeclared identifier 'params'
    12057 |         if (!!params->eht_cap != !!params->eht_oper)
          |               ^~~~~~
   net/wireless/nl80211.c:12057:29: error: use of undeclared identifier 'params'
    12057 |         if (!!params->eht_cap != !!params->eht_oper)
          |                                    ^~~~~~
   4 errors generated.


vim +/params +12054 net/wireless/nl80211.c

 12020	
 12021	static int nl80211_parse_counter_offsets(struct cfg80211_registered_device *rdev,
 12022						 const u8 *data, size_t datalen,
 12023						 int first_count, struct nlattr *attr,
 12024						 const u16 **offsets, unsigned int *n_offsets)
 12025	{
 12026		int i;
 12027	
 12028		*n_offsets = 0;
 12029	
 12030		if (!attr)
 12031			return 0;
 12032	
 12033		if (!nla_len(attr) || (nla_len(attr) % sizeof(u16)))
 12034			return -EINVAL;
 12035	
 12036		*n_offsets = nla_len(attr) / sizeof(u16);
 12037		if (rdev->wiphy.max_num_csa_counters &&
 12038		    (*n_offsets > rdev->wiphy.max_num_csa_counters))
 12039			return -EINVAL;
 12040	
 12041		*offsets = nla_data(attr);
 12042	
 12043		/* sanity checks - counters should fit and be the same */
 12044		for (i = 0; i < *n_offsets; i++) {
 12045			u16 offset = (*offsets)[i];
 12046	
 12047			if (offset >= datalen)
 12048				return -EINVAL;
 12049	
 12050			if (first_count != -1 && data[offset] != first_count)
 12051				return -EINVAL;
 12052		}
 12053	
 12054		if (!!params->he_cap != !!params->he_oper)
 12055			return -EINVAL;
 12056	
 12057		if (!!params->eht_cap != !!params->eht_oper)
 12058			return -EINVAL;
 12059	
 12060		return 0;
 12061	}
 12062	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] wifi: cfg80211: enforce HE/EHT cap/oper consistency

[kernel test robot]

Hi Johannes,

kernel test robot noticed the following build errors:

[auto build test ERROR on wireless-next/main]
[also build test ERROR on wireless/main linus/master v7.1-rc6 next-20260602]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Johannes-Berg/wifi-cfg80211-enforce-HE-EHT-cap-oper-consistency/20260603-173706
base:   https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main
patch link:    https://lore.kernel.org/r/20260603091812.101894-2-johannes%40sipsolutions.net
patch subject: [PATCH] wifi: cfg80211: enforce HE/EHT cap/oper consistency
config: x86_64-rhel-9.4 (https://download.01.org/0day-ci/archive/20260603/202606032002.XZQOw63p-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260603/202606032002.XZQOw63p-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202606032002.XZQOw63p-lkp@intel.com/

All errors (new ones prefixed by >>):

   net/wireless/nl80211.c: In function 'nl80211_parse_counter_offsets':
>> net/wireless/nl80211.c:12054:15: error: 'params' undeclared (first use in this function); did you mean 'parameq'?
   12054 |         if (!!params->he_cap != !!params->he_oper)
         |               ^~~~~~
         |               parameq
   net/wireless/nl80211.c:12054:15: note: each undeclared identifier is reported only once for each function it appears in


vim +12054 net/wireless/nl80211.c

 12020	
 12021	static int nl80211_parse_counter_offsets(struct cfg80211_registered_device *rdev,
 12022						 const u8 *data, size_t datalen,
 12023						 int first_count, struct nlattr *attr,
 12024						 const u16 **offsets, unsigned int *n_offsets)
 12025	{
 12026		int i;
 12027	
 12028		*n_offsets = 0;
 12029	
 12030		if (!attr)
 12031			return 0;
 12032	
 12033		if (!nla_len(attr) || (nla_len(attr) % sizeof(u16)))
 12034			return -EINVAL;
 12035	
 12036		*n_offsets = nla_len(attr) / sizeof(u16);
 12037		if (rdev->wiphy.max_num_csa_counters &&
 12038		    (*n_offsets > rdev->wiphy.max_num_csa_counters))
 12039			return -EINVAL;
 12040	
 12041		*offsets = nla_data(attr);
 12042	
 12043		/* sanity checks - counters should fit and be the same */
 12044		for (i = 0; i < *n_offsets; i++) {
 12045			u16 offset = (*offsets)[i];
 12046	
 12047			if (offset >= datalen)
 12048				return -EINVAL;
 12049	
 12050			if (first_count != -1 && data[offset] != first_count)
 12051				return -EINVAL;
 12052		}
 12053	
 12054		if (!!params->he_cap != !!params->he_oper)
 12055			return -EINVAL;
 12056	
 12057		if (!!params->eht_cap != !!params->eht_oper)
 12058			return -EINVAL;
 12059	
 12060		return 0;
 12061	}
 12062	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki