[PATCH AUTOSEL 6.18] wifi: mac80211: avoid out-of-bounds access in monitor

[Sasha Levin <sashal@kernel.org>]

From: Miri Korenblit <miriam.rachel.korenblit@intel.com>

[ Upstream commit 03c41203ee5a833a9d7a7630be190830cede29d8 ]

In NAN, we don't know on what band the frame will be sent. Therefore we
set info->band to NUM_NL80211_BANDS. However, this leads to out-of-bound
access in ieee80211_add_tx_radiotap_header when we try to access the
sbands array.

Fix it by not accessing the array if the band is NUM_NL80211_BANDS.
This means that we will not report rate info for legacy rate in NAN.
But nobody really cares about it.

Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260504101829.346c9893d136.I15919027597c04ec35c6217db6e52e2a605e5cfc@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: `wifi: mac80211: avoid out-of-bounds access
in monitor`

**Local tree:** Linux **6.18.43** (`git describe HEAD` →
`v6.18.43-1-gc7f0dac02d232`)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Subject line
**Record:** `[wifi: mac80211]` `[avoid]` — prevent out-of-bounds array
access in monitor-mode TX radiotap header construction.

### Step 1.2: Tags
**Record:**
- **Reviewed-by:** Ilan Peer \<ilan.peer@intel.com\>
- **Reviewed-by:** Johannes Berg \<johannes.berg@intel.com\> (mac80211
  maintainer)
- **Signed-off-by:** Miri Korenblit
  \<miriam.rachel.korenblit@intel.com\> (author)
- **Signed-off-by:** Johannes Berg (maintainer commit)
- **Link:** https://patch.msgid.link/20260504101829.346c9893d136.I159190
  27597c04ec35c6217db6e52e2a605e5cfc@changeid
- No Fixes:, Reported-by:, Tested-by:, Cc: stable@vger.kernel.org
- Notable: dual Reviewed-by including subsystem maintainer; no
  fuzzer/user bug report

### Step 1.3: Body analysis
**Record:**
- **Bug:** For NAN, TX band is set to `NUM_NL80211_BANDS` because the
  actual band is unknown at TX time.
- **Symptom:** `ieee80211_add_tx_radiotap_header()` indexes
  `local->hw.wiphy->bands[info->band]` with that sentinel value → out-
  of-bounds access.
- **Trigger path:** NAN transmission + monitor interface capturing TX
  frames.
- **Root cause:** Missing bounds check before `bands[]` lookup in the
  legacy-rate radiotap path.
- **Functional trade-off:** Legacy rate is not reported in radiotap for
  NAN frames (acceptable; author notes nobody cares).

### Step 1.4: Hidden bug fix?
**Record:** Not disguised — explicitly an OOB access fix, though
described as monitor/radiotap rather than "crash fix."

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Inventory
**Record:**
- **Files:** `net/mac80211/status.c` (+1 functional line, copyright year
  bump)
- **Functions:** `ieee80211_add_tx_radiotap_header()`
- **Scope:** Single-file, surgical (1-line logic change)

### Step 2.2: Code flow change
**Record:**
- **Hunk (lines ~298–305):**
  - **Before:** If no `status_rate`, and `rates[0].idx >= 0` with legacy
    flags, always dereference `wiphy->bands[info->band]`.
  - **After:** Same, but only when `info->band < NUM_NL80211_BANDS`.
  - **Path:** TX status → monitor radiotap header fill on legacy (non-
    MCS/VHT) rate reporting.

### Step 2.3: Bug mechanism
**Record:**
- **Category:** Buffer/out-of-bounds access (array index past end).
- **Mechanism:** `struct ieee80211_supported_band
  *bands[NUM_NL80211_BANDS]` (verified in
  `include/net/cfg80211.h:6076`). Valid indices are `0 ..
  NUM_NL80211_BANDS-1`. `NUM_NL80211_BANDS` is a sentinel (value 6 in
  this tree: 2G/5G/60G/6G/S1G/LC). NAN TX sets `info->band =
  NUM_NL80211_BANDS` in `ieee80211_tx_skb_tid()`
  (`net/mac80211/tx.c:6316-6317`). Indexing `bands[NUM_NL80211_BANDS]`
  is OOB; subsequent `sband->bitrates[...]` can crash or corrupt memory.

### Step 2.4: Fix quality
**Record:**
- **Obviously correct:** Matches existing guards elsewhere in mac80211
  (`tx.c:62`, `tx.c:689`, `rate.c:101`, `rate.c:907`).
- **Minimal:** One condition added.
- **Regression risk:** Very low — only skips optional radiotap legacy-
  rate field when band is unknown.
- **No API changes.**

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
**Record:** `git blame` on changed lines shows all of `status.c`
attributed to commit `19eef1d98eeda` due to flattened/squashed file
history in this checkout. **UNVERIFIED:** exact commit that introduced
the missing guard.

### Step 3.2: Fixes: tag
**Record:** N/A — no Fixes: tag in commit message.

### Step 3.3: Related file history
**Record:** `git log --oneline -20 -- net/mac80211/status.c` shows only
the squashed import commit. Recent mac80211 fixes in tree include
radiotap bounds work (`9b40c59bab08f` — injected antenna index). NAN-
related work by same author exists (`08e7ae48e175c` cfg80211 NAN). Buggy
code **is present** in current tree without this fix.

### Step 3.4: Author context
**Record:** Miri Korenblit is an active WiFi contributor; recent
mac80211 commits in tree (`7a1bec39c014e`, `b4b065a880997`). Johannes
Berg is mac80211 maintainer and reviewed.

### Step 3.5: Dependencies
**Record:** Standalone — no series, no prerequisite commits. Only
requires existing NAN `band = NUM_NL80211_BANDS` assignment (present at
`tx.c:6317`) and existing `ieee80211_add_tx_radiotap_header()` (present
at `status.c:257`).

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original discussion
**Record:** `b4 dig -c <message-id>` failed — commit not in local tree.
`b4 dig -c HEAD` matched unrelated commit. lore.kernel.org and
patch.msgid.link blocked by Anubis bot protection. **UNVERIFIED:** full
mailing-list thread content.

### Step 4.2: Reviewers
**Record:** Commit message includes Reviewed-by from Johannes Berg
(maintainer) and Ilan Peer. **UNVERIFIED** via `b4 dig -w` (no commit
hash available locally).

### Step 4.3: Bug report
**Record:** No Reported-by, syzbot, or bugzilla link. Bug identified via
code-path analysis (NAN sentinel band + monitor radiotap).

### Step 4.4: Series context
**Record:** Standalone single-patch fix; no "patch X/Y" indication.

### Step 4.5: Stable list history
**Record:** **UNVERIFIED** — could not search lore stable archive (bot
protection).

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key functions
**Record:** `ieee80211_add_tx_radiotap_header()`, called from
`ieee80211_tx_monitor()`.

### Step 5.2: Callers
**Record:**
- `ieee80211_tx_monitor()` ← `ieee80211_tx_status_ext()` path when
  `local->tx_mntrs` (`status.c:1109-1110`)
- `ieee80211_tx_monitor()` ← `ieee80211_beacon_get_tim()` for beacon TX
  monitor copy (`tx.c:5819`)
- `ieee80211_tx_status_ext()` ← `ieee80211_tx_status_skb()` and driver
  TX status callbacks

### Step 5.3: Callees
**Record:** `skb_push`, `memset`, `local->hw.wiphy->bands[info->band]`
(the OOB site), `sband->bitrates[...]`.

### Step 5.4: Reachability
**Record:**
1. NAN interface started (`NL80211_IFTYPE_NAN`)
2. Frame TX via `ieee80211_tx_skb_tid()` → `band = NUM_NL80211_BANDS`
3. At least one monitor interface without `MONITOR_FLAG_SKIP_TX` →
   `local->tx_mntrs > 0` (`iface.c:1149-1150`)
4. TX completes with legacy rate info in skb CB (non-MCS/VHT,
   `rates[0].idx >= 0`)
5. `ieee80211_add_tx_radiotap_header()` OOB on `bands[]`

Reachable from normal Wi-Fi Aware (NAN) usage with packet capture
(Wireshark/tcpdump on monitor). Not theoretical.

### Step 5.5: Similar patterns
**Record:** Same `info->band` / `NUM_NL80211_BANDS` guard pattern
already used in:
- `net/mac80211/tx.c:62-63` (`ieee80211_duration`)
- `net/mac80211/tx.c:689-692` (rate control)
- `net/mac80211/rate.c:101-102`, `907` (rate control TX status)

`status.c` radiotap path was the outlier.

---

## PHASE 6: CROSS-REFERENCE WITH LOCAL TREE (6.18.43)

### Step 6.1: Buggy code present?
**Record:** **YES.** Current `status.c:298-305` lacks `info->band <
NUM_NL80211_BANDS` check. NAN sentinel assignment exists at
`tx.c:6316-6317`. Fix is **not** already applied.

### Step 6.2: Backport complications
**Record:** Expected **clean apply** — single-line addition in well-
isolated `else if` branch. Context at lines 298-300 matches the provided
diff exactly.

### Step 6.3: Duplicate fix?
**Record:** `git grep "avoid out-of-bounds access in monitor"` — no
matches. No equivalent fix found in tree.

---

## PHASE 7: SUBSYSTEM CONTEXT

### Step 7.1: Subsystem criticality
**Record:** **net/mac80211** — IMPORTANT (802.11 stack used broadly;
monitor mode used by developers, security tools, Android debugging).

### Step 7.2: Activity
**Record:** Active — multiple recent mac80211 fixes in this tree
(radiotap bounds, memory leaks, MLD fixes).

---

## PHASE 8: IMPACT AND RISK

### Step 8.1: Who is affected
**Record:** Users of **NAN (Wi-Fi Aware)** with **TX monitor
interfaces** enabled. Config-specific but real (Android Wi-Fi Aware
development/capture scenarios).

### Step 8.2: Trigger conditions
**Record:** NAN TX + monitor without SKIP_TX + legacy rate in TX status
metadata. Unprivileged users can trigger if they can create NAN and
monitor interfaces (typically requires appropriate
permissions/CAP_NET_ADMIN).

### Step 8.3: Failure mode severity
**Record:** OOB read of pointer array → likely **NULL or garbage pointer
dereference** → kernel oops/panic. **Severity: HIGH** (kernel crash).
Not data corruption in the common case, but memory safety violation.

### Step 8.4: Risk-benefit
**Record:**
- **Benefit:** Prevents kernel crash on a real, reachable code path;
  aligns with existing subsystem defensive pattern.
- **Risk:** Minimal — one bounds check; only affects optional radiotap
  metadata.
- **Ratio:** Strongly favorable.

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence summary

**FOR backport:**
- Real OOB bug with clear mechanism
- Kernel crash potential
- Tiny, obviously correct fix
- Reviewed by mac80211 maintainer (Johannes Berg)
- Consistent with existing guards in same subsystem
- Buggy code confirmed present in 6.18.43 tree
- Clean backport expected

**AGAINST backport:**
- Niche trigger (NAN + TX monitor, not every user)
- No syzbot/user Reported-by (found via code review)
- Mailing-list discussion unverified

**Unresolved:** Exact introduction commit; lore thread content; whether
stable maintainers already discussed it.

### Step 9.2: Stable rules checklist
1. Obviously correct and tested? **PASS** — logic mirrors existing
   mac80211 pattern; maintainer-reviewed.
2. Fixes a real bug? **PASS** — OOB array access on reachable path.
3. Important issue? **PASS** — kernel crash / memory safety (HIGH).
4. Small and contained? **PASS** — 1-line functional change.
5. No new features/APIs? **PASS** — defensive bounds check only.
6. Can apply to local tree? **PASS** — code present, patch context
   matches.

### Step 9.3: Exception category
**Record:** N/A (not device ID, quirk, DT, build fix, or docs — standard
bug fix).

### Step 9.4: Decision rationale
For **this 6.18.43 tree**, the NAN TX path sets `info->band` to the
`NUM_NL80211_BANDS` sentinel, and the monitor radiotap header code
indexes `wiphy->bands[]` without a bounds check. That is a verified out-
of-bounds access that can crash the kernel when Wi-Fi Aware traffic is
captured on a TX-enabled monitor interface. The fix is minimal, matches
established patterns in the same files, and has maintainer review. The
trigger is narrower than a core networking crash, but the failure mode
is severe and the backport risk is negligible.

---

## Verification

- [Phase 1] Parsed subject, tags, body from user-provided commit message
- [Phase 1] Identified Reviewed-by: Johannes Berg, Ilan Peer
- [Phase 2] Read `status.c:257-310` — buggy `bands[info->band]` access
  without band check
- [Phase 2] Read `cfg80211.h:6076` — `bands[NUM_NL80211_BANDS]` array
  size
- [Phase 2] Read `nl80211.h:5631-5639` — `NUM_NL80211_BANDS` = 6
  (sentinel index)
- [Phase 2] Confirmed fix adds `info->band < NUM_NL80211_BANDS` guard
- [Phase 3] `git blame -L 295,310 status.c` — flattened history (all one
  commit)
- [Phase 3] `git log --oneline -20 -- net/mac80211/status.c` — squashed
  history
- [Phase 3] `git log --author=Korenblit` — author has recent mac80211
  commits
- [Phase 4] `b4 dig -c <message-id>` — failed, commit not in tree
- [Phase 4] WebFetch lore.kernel.org — blocked (Anubis)
- [Phase 4] WebFetch patch.msgid.link — blocked (Anubis)
- [Phase 5] `grep ieee80211_tx_monitor` — callers at `status.c:1110`,
  `tx.c:5819`
- [Phase 5] Read `tx.c:6316-6317` — NAN sets `band = NUM_NL80211_BANDS`
- [Phase 5] Read `iface.c:1149-1150` — `tx_mntrs` incremented for TX
  monitor
- [Phase 5] Grep `info->band.*NUM_NL80211_BANDS` in mac80211 — guards in
  `tx.c`, `rate.c`; missing in `status.c`
- [Phase 6] `git describe HEAD` / `make kernelversion` — **6.18.43**
- [Phase 6] Confirmed fix NOT present in current `status.c`
- [Phase 6] `grep "avoid out-of-bounds access in monitor"` — no existing
  fix
- [Phase 8] Traced call chain: NAN TX → TX status →
  `ieee80211_tx_monitor` → radiotap OOB
- **UNVERIFIED:** Exact commit that introduced NAN `band =
  NUM_NL80211_BANDS`
- **UNVERIFIED:** Mailing-list review thread and stable nominations
- **UNVERIFIED:** `git apply --check` (patch file formatting issue in
  test; manual line comparison confirms clean apply)

**YES**

 net/mac80211/status.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 4b38aa0e902a8..8716eda8317d1 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -5,7 +5,7 @@
  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
  * Copyright 2008-2010	Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2013-2014  Intel Mobile Communications GmbH
- * Copyright 2021-2025  Intel Corporation
+ * Copyright 2021-2026  Intel Corporation
  */
 
 #include <linux/export.h>
@@ -295,9 +295,10 @@ ieee80211_add_tx_radiotap_header(struct ieee80211_local *local,
 						 RATE_INFO_FLAGS_VHT_MCS |
 						 RATE_INFO_FLAGS_HE_MCS)))
 			legacy_rate = status_rate->rate_idx.legacy;
-	} else if (info->status.rates[0].idx >= 0 &&
-		 !(info->status.rates[0].flags & (IEEE80211_TX_RC_MCS |
-						  IEEE80211_TX_RC_VHT_MCS))) {
+	} else if (info->band < NUM_NL80211_BANDS &&
+		   info->status.rates[0].idx >= 0 &&
+		   !(info->status.rates[0].flags & (IEEE80211_TX_RC_MCS |
+						    IEEE80211_TX_RC_VHT_MCS))) {
 		struct ieee80211_supported_band *sband;
 
 		sband = local->hw.wiphy->bands[info->band];
-- 
2.53.0