From: Slawomir Stepien <sst@poczta.fm>
To: Johannes Berg <johannes@sipsolutions.net>
Cc: syzkaller-bugs@googlegroups.com, linux-wireless@vger.kernel.org,
linux-kernel@vger.kernel.org, syzbot@lists.linux.dev,
syzbot+9bdc0c5998ab45b05030@syzkaller.appspotmail.com
Subject: Re: [PATCH 3/3] wifi: cfg80211: check if AP has been started before adding new station
Date: Tue, 8 Sep 2026 15:35:57 +0200 [thread overview]
Message-ID: <aqAPPd4qHy0qjo1k@nr200> (raw)
In-Reply-To: <22e7ddfc50d7a6a16c437b876dab5fe223799610.camel@sipsolutions.net>
On wrz 08, 2026 14:25, Johannes Berg wrote:
> On Tue, 2026-09-08 at 13:59 +0200, Slawomir Stepien wrote:
> > >
> > > Don't think you're missing anything, there's just the block handling
> > > param->vlan in add_station, it's dead code now. But why not kill it?
> >
> > For the reason explained below (in my previous message).
> > There can still be a command from userspace with AP base interface (as wdev) with
> > attrs[NL80211_ATTR_STA_VLAN] set and this block will be executed in such case. Right?
>
> D'oh. Going too fast, I somehow managed to not connect the two things.
> Sorry!
>
> But it's another messy code path - if you have AP A and B, and VLANs A'
> and B' belonging to A and B respectively, then you can
>
> add_station(A, vlan=B')
>
> and it gets added on B/B', and B must be IFF_UP (because B' must be
> IFF_UP) but doesn't need to be beaconing and we're back to the bug, it
> seems? Maybe I'm missing something.
You can't add a vlan interface that dosn't have correct "parent" wiphy, get_vlan() checks that
already:
v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
if (!v)
return ERR_PTR(-ENODEV);
if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
ret = -EINVAL;
goto error;
}
> Since VLANs have to have the same local address as their AP (i.e. we
> need addr(B') == addr(B)), I guess get_vlan() could check this though,
> if it's indeed a problem, and that would avoid it through the chain of
> other invariants (IFF_UP, beaconing, etc.)
This check I've pasted should be good enough, right?
--
Slawomir Stepien
next prev parent reply other threads:[~2026-09-08 13:36 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-13 9:04 [PATCH 1/3] wifi: cfg80211: do not support direct add of station to AP_VLAN interfaces Slawomir Stepien
2026-08-13 9:04 ` [PATCH 2/3] wifi: cfg80211: move link_id validation earlier in nl80211_new_station() Slawomir Stepien
2026-08-13 9:04 ` [PATCH 3/3] wifi: cfg80211: check if AP has been started before adding new station Slawomir Stepien
2026-09-04 9:25 ` Johannes Berg
2026-09-07 9:46 ` Slawomir Stepien
2026-09-07 9:47 ` Johannes Berg
2026-09-08 9:44 ` Slawomir Stepien
2026-09-08 9:46 ` Johannes Berg
2026-09-08 11:59 ` Slawomir Stepien
2026-09-08 12:25 ` Johannes Berg
2026-09-08 13:35 ` Slawomir Stepien [this message]
2026-09-08 13:37 ` Johannes Berg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aqAPPd4qHy0qjo1k@nr200 \
--to=sst@poczta.fm \
--cc=johannes@sipsolutions.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=syzbot+9bdc0c5998ab45b05030@syzkaller.appspotmail.com \
--cc=syzbot@lists.linux.dev \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox