From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E52A3383C7C; Mon, 23 Mar 2026 14:56:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774277788; cv=none; b=OqJO9cahfabm8SsjP/I2Mg0bWvJYVwT9kjJsHsa9zphjzoGUbBJgI4dv/wKnAakR7M2SFCMbLikcyK61rTW5h1DKp4/l1OIfFQJhGzXbysJFF3sFVb4V3biXMrslwyHD4gViJ1FqjNsDXz82KNGLT1QLwqK3xbdzjCefeQ+Ijw8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774277788; c=relaxed/simple; bh=DZpMDbdRMjpGom5mdKyHJhpyE7TTtYhfvPXob5z4FVk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fg1cQ4enlMYkaePUh0vP8qsYsCZaG4PJ+LtkgTAvrysH2HhYnzzv9A1z9DWHD04fu0ANX11fEI/fWVH68MYUDWw0v3jOJ/axLqjKAPsbKOrFwbyq9C572poZFHNgqfAzpi6dq+nah1i2K7E0MILrn46AoIRJn8bCQ9bQhRtj/OE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=sQ3bN4zD; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="sQ3bN4zD" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7112BC4CEF7; Mon, 23 Mar 2026 14:56:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1774277787; bh=DZpMDbdRMjpGom5mdKyHJhpyE7TTtYhfvPXob5z4FVk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sQ3bN4zDpxsip2YC6A2IAGc7+ZVJfifq27zVK6E9XyKg8d4W0qn9TnHz4vhe5cQbB tXQPTDySTmouqHv+er/qmoKI+w4psBArVYf9f5WLfXJuq/yIvP2fTZMxwZ6QgerPZO JaWCErLO2pzi/1Hrxh5I51D/wDXz2XhjYnNoONQQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+b09c1af8764c0097bb19@syzkaller.appspotmail.com, Johannes Berg Subject: [PATCH 6.6 104/567] wifi: radiotap: reject radiotap with unknown bits Date: Mon, 23 Mar 2026 14:40:24 +0100 Message-ID: <20260323134536.399758727@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260323134533.749096647@linuxfoundation.org> References: <20260323134533.749096647@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johannes Berg commit c854758abe0b8d86f9c43dc060ff56a0ee5b31e0 upstream. The radiotap parser is currently only used with the radiotap namespace (not with vendor namespaces), but if the undefined field 18 is used, the alignment/size is unknown as well. In this case, iterator->_next_ns_data isn't initialized (it's only set for skipping vendor namespaces), and syzbot points out that we later compare against this uninitialized value. Fix this by moving the rejection of unknown radiotap fields down to after the in-namespace lookup, so it will really use iterator->_next_ns_data only for vendor namespaces, even in case undefined fields are present. Cc: stable@vger.kernel.org Fixes: 33e5a2f776e3 ("wireless: update radiotap parser") Reported-by: syzbot+b09c1af8764c0097bb19@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/69944a91.a70a0220.2c38d7.00fc.GAE@google.com Link: https://patch.msgid.link/20260217120526.162647-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/wireless/radiotap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/wireless/radiotap.c +++ b/net/wireless/radiotap.c @@ -239,14 +239,14 @@ int ieee80211_radiotap_iterator_next( default: if (!iterator->current_namespace || iterator->_arg_index >= iterator->current_namespace->n_bits) { - if (iterator->current_namespace == &radiotap_ns) - return -ENOENT; align = 0; } else { align = iterator->current_namespace->align_size[iterator->_arg_index].align; size = iterator->current_namespace->align_size[iterator->_arg_index].size; } if (!align) { + if (iterator->current_namespace == &radiotap_ns) + return -ENOENT; /* skip all subsequent data */ iterator->_arg = iterator->_next_ns_data; /* give up on this namespace */