Linux wireless drivers development
 help / color / mirror / Atom feed
From: Slawomir Stepien <sst@poczta.fm>
To: Johannes Berg <johannes@sipsolutions.net>
Cc: syzkaller-bugs@googlegroups.com, linux-wireless@vger.kernel.org,
	linux-kernel@vger.kernel.org, syzbot@lists.linux.dev,
	syzbot+9bdc0c5998ab45b05030@syzkaller.appspotmail.com
Subject: Re: [PATCH 3/3] wifi: cfg80211: check if AP has been started before adding new station
Date: Tue, 8 Sep 2026 15:35:57 +0200	[thread overview]
Message-ID: <aqAPPd4qHy0qjo1k@nr200> (raw)
In-Reply-To: <22e7ddfc50d7a6a16c437b876dab5fe223799610.camel@sipsolutions.net>

On wrz 08, 2026 14:25, Johannes Berg wrote:
> On Tue, 2026-09-08 at 13:59 +0200, Slawomir Stepien wrote:
> > > 
> > > Don't think you're missing anything, there's just the block handling
> > > param->vlan in add_station, it's dead code now. But why not kill it?
> > 
> > For the reason explained below (in my previous message).
> > There can still be a command from userspace with AP base interface (as wdev) with
> > attrs[NL80211_ATTR_STA_VLAN] set and this block will be executed in such case. Right?
> 
> D'oh. Going too fast, I somehow managed to not connect the two things.
> Sorry!
> 
> But it's another messy code path - if you have AP A and B, and VLANs A'
> and B' belonging to A and B respectively, then you can
> 
> 	add_station(A, vlan=B')
> 
> and it gets added on B/B', and B must be IFF_UP (because B' must be
> IFF_UP) but doesn't need to be beaconing and we're back to the bug, it
> seems? Maybe I'm missing something.

You can't add a vlan interface that dosn't have correct "parent" wiphy, get_vlan() checks that
already:

	v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
	if (!v)
		return ERR_PTR(-ENODEV);

	if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
		ret = -EINVAL;
		goto error;
	}

> Since VLANs have to have the same local address as their AP (i.e. we
> need addr(B') == addr(B)), I guess get_vlan() could check this though,
> if it's indeed a problem, and that would avoid it through the chain of
> other invariants (IFF_UP, beaconing, etc.)

This check I've pasted should be good enough, right?

-- 
Slawomir Stepien

  reply	other threads:[~2026-09-08 13:36 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-13  9:04 [PATCH 1/3] wifi: cfg80211: do not support direct add of station to AP_VLAN interfaces Slawomir Stepien
2026-08-13  9:04 ` [PATCH 2/3] wifi: cfg80211: move link_id validation earlier in nl80211_new_station() Slawomir Stepien
2026-08-13  9:04 ` [PATCH 3/3] wifi: cfg80211: check if AP has been started before adding new station Slawomir Stepien
2026-09-04  9:25   ` Johannes Berg
2026-09-07  9:46     ` Slawomir Stepien
2026-09-07  9:47       ` Johannes Berg
2026-09-08  9:44     ` Slawomir Stepien
2026-09-08  9:46       ` Johannes Berg
2026-09-08 11:59         ` Slawomir Stepien
2026-09-08 12:25           ` Johannes Berg
2026-09-08 13:35             ` Slawomir Stepien [this message]
2026-09-08 13:37               ` Johannes Berg

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=aqAPPd4qHy0qjo1k@nr200 \
    --to=sst@poczta.fm \
    --cc=johannes@sipsolutions.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=syzbot+9bdc0c5998ab45b05030@syzkaller.appspotmail.com \
    --cc=syzbot@lists.linux.dev \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox