From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794591020; b=zYkkDmXo6NMciqozDGBnXDBmrQCS6lO+7rthkc9JVl4ftuJ6jVHeWRTyS7eLIPb7HiEQ n+esTcfhRSK8hLGp9xlTr2aeS96SsLsaKxaz3CIzCnnAe+xbU+FLv5zvyFBG76Qksq6zv zzgaABix5ekOsNldtsrR8PmzSnKO4jPrzOnivzlx7ijlxWD1ttn/V09AmY3kN18PlZ6jq He/xoPT6sYblIp+gOIIzxqps+kYwPb1pn4HSxD1QkjkwAU52xYNKgss7iNQ5Vf/lfNdYh 2CB5uZgNRllGqN8KQUD+/N9xIqM7j47W+zaXLHHaI3agX4Z2u7wMubH4NpAU2ywuR1w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794591020; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=ko8KEgi15tGNBn/uDBbVckYlKV2cf0GV95bGTA7bm1g=; b=5Z+yC05LvjyLO8FFM4nVvalBAYjD5dKuBTHeXmCyLALSq91zpuXW4YRB9uYGBKNl5Jp5 Lp8fXQm6tk9fv1NyisjY632s6q3iRwlv5OdA/Iie8UT4fR9mJkPAIliJjYdFYnc6znlAz 3qD/F7ERAJBmEKpNhi8EjYndWJDAiYUyDs/oyibuCNJtUDWKSkF/GRTE2pE4rqvIrhtZm XEmw1WtDuH4nm6Sqn4uPijr1oBoSeCQJV7GcyRvWfP4lnb88IDSRBs9fPZfT76JLzExWz 3WhwRHDNk4njIupWvrTEWCBSIWzjMyGtaVKwBfK6r9DLFJSEk/DrD5TCAwBP6XW24CA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=j+qoeRP7; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30CEE6070F33; Fri, 13 Nov 2026 17:30:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=j+qoeRP7 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 90F201F000C4; Fri, 13 Nov 2026 17:30:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794591019; bh=ko8KEgi15tGNBn/uDBbVckYlKV2cf0GV95bGTA7bm1g=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=j+qoeRP7SoLdNzyI0ahV4TarcojNvMXwxn5y0+gBENH7/H0gk/zN+aEKcu3lN5nDW v4ofvBKHvO7M9+WkoCT/K0L6CsOWcf/VASHw3akPIiJW8Hbtejm4reR2CyYkZOF98y VNLQKTrUklCKy8t2e60Roske4aNN2czCA4x4rYQk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Weigang He , Johannes Berg , Sasha Levin Subject: [PATCH 6.12 186/670] wifi: mac80211: reload TDLS header pointer after skb_linearize() Date: Fri, 13 Nov 2026 10:45:50 -0500 Message-ID: <20261113153818.323699486@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153811.177190860@linuxfoundation.org> References: <20261113153811.177190860@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Weigang He [ Upstream commit 35c5a5ea4418571997a7e7af3e7e8922b136f6e6 ] ieee80211_process_tdls_channel_switch() sets tf = skb->data before it calls skb_linearize(), and reads tf->action_code afterwards. ieee80211_rx_h_data() queues TDLS channel switch requests and responses to the interface after pulling only offsetof(struct ieee80211_tdls_data, u) bytes, so the skb can still be non-linear when the interface work handles it. Drivers that build paged RX skbs do this for every frame that does not fit into the skb head, e.g. iwlwifi (mvm), which is also the only mac80211 driver that sets NL80211_FEATURE_TDLS_CHANNEL_SWITCH. If the remaining data does not fit into the tailroom, skb_linearize() moves the data to a new head and frees the old one, and the action code is then read from freed memory. Depending on what that memory holds by then, the frame is handled as before or ends in the WARN_ON_ONCE() of the default case. The frame only has to be a data frame with the TDLS ethertype from an authorized peer, e.g. relayed by the AP from another station in the BSS; the read happens before the sender is checked to be a TDLS peer. Load tf after skb_linearize(), as the request and response handlers already do. Found by static analysis tool CodeQL. Fixes: 8a4d32f30d11 ("mac80211: add TDLS channel-switch Rx flow") Cc: stable@vger.kernel.org Assisted-by: LLM codeql Signed-off-by: Weigang He Link: https://patch.msgid.link/20261021145807.3018338-1-geoffreyhe2@gmail.com Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin --- net/mac80211/tdls.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c index b4bedf0b2b552..33657ca92ae57 100644 --- a/net/mac80211/tdls.c +++ b/net/mac80211/tdls.c @@ -2016,7 +2016,7 @@ void ieee80211_process_tdls_channel_switch(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb) { - struct ieee80211_tdls_data *tf = (void *)skb->data; + struct ieee80211_tdls_data *tf; struct wiphy *wiphy = sdata->local->hw.wiphy; lockdep_assert_wiphy(wiphy); @@ -2032,6 +2032,7 @@ ieee80211_process_tdls_channel_switch(struct ieee80211_sub_if_data *sdata, * The packet/size was already validated by mac80211 Rx path, only look * at the action type. */ + tf = (void *)skb->data; switch (tf->action_code) { case WLAN_TDLS_CHANNEL_SWITCH_REQUEST: ieee80211_process_tdls_channel_switch_req(sdata, skb); -- 2.53.0