From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794585392; b=a3gj6Je4wOpaJdm8Ad0E06p9hKOu9tZYX4gpE+gKVztbwTt3/EnJ86uPH4Or/jdKaRzd BzLDVqCPgqxND+uXWvOe11m3kJyGirCsvWsrEBL7cgD9WCNTFcUICGs1beOHxM28mxgaE n0ZHLmBM70Fsqwy4y7vhiBIZlVN+/8JO8CjlcbFcsoGEU6TWSBf2+xMAqkCh3GE2OrJql YIqkuvb8ov/iQ13ruibdB6X2u2/qjxG7vaztTmZhkAjZ5OGd8/tiTt/1N0Np8zn8joO9f V5oVMAeAspH+4diagu9no/fVTgFrmuzm10L3DL7ReyUktuUXViuAsZi23HOp4BHKugw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794585392; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=F3XiE5NAzkiemtBKVQgA+CYS1L4hK8J51iXcnNt8XPw=; b=Ybnel3vBGcbqnXwE/TM9w/OXWiPoS0c0vLO+CKGUYP27v8YV2s7/cPpeWRZ9BRYdbTGp Wuwsa6IU6hbpquB3q51wIbp56Ji3vyvsqUu6cRjc/Mhdafvfz9QSWNEhsYjw4rW/DvPRe CxAT+/YOLkLOVoQEetFtp0bEAT5LXN7dGwrDOdu6NgFBZzTiKqawzR12V0eHWdVW0rJ1Q XlgVyOQ2ZfrM0cqqL2u4+dySwEs2C0eu11wOABNOFZjJLorzTyrCz+8UOB1DYJFHjNtdy WE4G8oIPqHLqBTFhqvLNC/22+DdVVvdq8WWX+47jfKVY7/DY/7ZZVygeAs3/IAiv6lw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=qk3y8g57; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 646276070FE8; Fri, 13 Nov 2026 15:56:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=qk3y8g57 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 116751F000D4; Fri, 13 Nov 2026 15:56:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794585392; bh=F3XiE5NAzkiemtBKVQgA+CYS1L4hK8J51iXcnNt8XPw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qk3y8g572jCMbpKpGoKfVjs0J/PtdxYdiSsp1uPhVxbSME6gGGZgse/2dnwjEO+Zy 0FRlDT9iDpqFoiVvQMJqgVV+Q6JkhCZtA8MUEw3Y6rM9xag4+YYXZoO+q9hJ1K7wcr In8RByh7M4/0KM4q6L7lCfcr2bFXRrHjGxuB7EY8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Weigang He , Johannes Berg , Sasha Levin Subject: [PATCH 7.3 064/507] wifi: mac80211: reload TDLS header pointer after skb_linearize() Date: Fri, 13 Nov 2026 10:46:08 -0500 Message-ID: <20261113153755.713598472@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153753.358973689@linuxfoundation.org> References: <20261113153753.358973689@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Weigang He [ Upstream commit 35c5a5ea4418571997a7e7af3e7e8922b136f6e6 ] ieee80211_process_tdls_channel_switch() sets tf = skb->data before it calls skb_linearize(), and reads tf->action_code afterwards. ieee80211_rx_h_data() queues TDLS channel switch requests and responses to the interface after pulling only offsetof(struct ieee80211_tdls_data, u) bytes, so the skb can still be non-linear when the interface work handles it. Drivers that build paged RX skbs do this for every frame that does not fit into the skb head, e.g. iwlwifi (mvm), which is also the only mac80211 driver that sets NL80211_FEATURE_TDLS_CHANNEL_SWITCH. If the remaining data does not fit into the tailroom, skb_linearize() moves the data to a new head and frees the old one, and the action code is then read from freed memory. Depending on what that memory holds by then, the frame is handled as before or ends in the WARN_ON_ONCE() of the default case. The frame only has to be a data frame with the TDLS ethertype from an authorized peer, e.g. relayed by the AP from another station in the BSS; the read happens before the sender is checked to be a TDLS peer. Load tf after skb_linearize(), as the request and response handlers already do. Found by static analysis tool CodeQL. Fixes: 8a4d32f30d11 ("mac80211: add TDLS channel-switch Rx flow") Cc: stable@vger.kernel.org Assisted-by: LLM codeql Signed-off-by: Weigang He Link: https://patch.msgid.link/20261021145807.3018338-1-geoffreyhe2@gmail.com Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin --- net/mac80211/tdls.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c index f663d28d9209c..71db07aa301b7 100644 --- a/net/mac80211/tdls.c +++ b/net/mac80211/tdls.c @@ -2021,7 +2021,7 @@ void ieee80211_process_tdls_channel_switch(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb) { - struct ieee80211_tdls_data *tf = (void *)skb->data; + struct ieee80211_tdls_data *tf; struct wiphy *wiphy = sdata->local->hw.wiphy; lockdep_assert_wiphy(wiphy); @@ -2037,6 +2037,7 @@ ieee80211_process_tdls_channel_switch(struct ieee80211_sub_if_data *sdata, * The packet/size was already validated by mac80211 Rx path, only look * at the action type. */ + tf = (void *)skb->data; switch (tf->action_code) { case WLAN_TDLS_CHANNEL_SWITCH_REQUEST: ieee80211_process_tdls_channel_switch_req(sdata, skb); -- 2.53.0