[PATCH] wifi: mac80211_hwsim: drop frames with invalid channel width

[lurenjia534 via B4 Relay <devnull+lurenjia534.outlook.com@kernel.org>]

From: lurenjia534 <lurenjia534@outlook.com>

A frame injected through a monitor interface can request a VHT transmit
rate wider than the channel configured on the simulated radio.  The rate
comes from userspace-provided radiotap metadata, so it can be invalid.

mac80211_hwsim_tx() currently warns and returns when the requested rate is
wider than the channel.  A warning is inappropriate for invalid userspace
input.  Moreover, hwsim owns the skb after its ->tx() callback is invoked,
so returning without reporting status or freeing the skb leaks it.

Drop frames with an invalid channel width and release their SKBs with
ieee80211_free_txskb().  Frames with valid rates continue through the
existing transmit path.

The reproducer triggered the warning in 20 of 20 unmodified-kernel boots.
With this change, 100 iterations completed without a warning on both the
report baseline and wireless/main.  An E2E control also confirmed that a
valid 20 MHz frame was forwarded while a 160 MHz request on the same
channel was dropped.

Fixes: 585625c955b1 ("mac80211_hwsim: check TX and STA bandwidth")
Reported-by: syzbot+435fdb053cf98bfa5778@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6a441a03.b42ede87.8e801.0009.GAE@google.com/
Tested-by: syzbot+435fdb053cf98bfa5778@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5.6 MAX
Signed-off-by: lurenjia534 <lurenjia534@outlook.com>
---
Testing:
- syzbot #syz test on wireless/main: pass
- original syzbot C reproducer: 20/20 report-baseline boots warned;
  unmodified wireless/main warned in 3/3 independent boots
- patched original reproducer: 100/100 iterations clean on both the report
  baseline and wireless/main
- monitor-injection E2E: valid 20 MHz frame forwarded; invalid 160 MHz
  frame dropped
- CONFIG_MAC80211_HWSIM=y/m runtime tests: clean, taint 0
- GCC x86-64 full y/m builds, GCC W=1, sparse, and Clang x86-64/arm64
  target builds: pass
---
 drivers/net/wireless/virtual/mac80211_hwsim_main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
index 75caa97bec..2d4bc3cd9a 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
@@ -2256,8 +2256,10 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
 		else if (rflags & IEEE80211_TX_RC_160_MHZ_WIDTH)
 			bw = NL80211_CHAN_WIDTH_160;
 
-		if (WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)))
+		if (hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)) {
+			ieee80211_free_txskb(hw, skb);
 			return;
+		}
 	}
 
 	/* wmediumd mode check */

---
base-commit: 2812e64e1575e05500a35c405aaa6e99b7d7930b
change-id: 20260802-mac80211-hwsim-invalid-width-97781b6ea768

Best regards,
--  
lurenjia534 <lurenjia534@outlook.com>