Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
milos-linux/net/mac80211
History
Deepanshu Kartikey 6c0cf89f36 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap 
When parsing the radiotap header of an injected frame,
ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value
directly as a shift count:

	info->control.antennas |= BIT(*iterator.this_arg);

*iterator.this_arg is an 8-bit value taken straight from the frame
supplied by userspace, so BIT() can be asked to shift by up to 255. That
is undefined behaviour on the unsigned long and is reported by UBSAN:

  UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30
  shift exponent 235 is too large for 64-bit type 'unsigned long'
  Call Trace:
   ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174
   ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451
   ...
   packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109

info->control.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna
indices 0 and 1 can ever be represented. Ignore any larger value instead
of shifting out of bounds.

Reported-by: syzbot+8e0622f6d9446420271f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8e0622f6d9446420271f
Fixes: ef246a1480 ("wifi: mac80211: support antenna control in injection")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Link: https://patch.msgid.link/20260531011721.102941-1-kartikey406@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-02 13:26:33 +02:00
..
tests wifi: mac80211: tests: mark HT check strict 2026-05-04 08:54:52 +02:00
aead_api.c
aead_api.h
aes_ccm.h
aes_cmac.c wifi: mac80211: Use AES-CMAC library in ieee80211_aes_cmac() 2026-03-09 13:27:21 -07:00
aes_cmac.h wifi: mac80211: Use AES-CMAC library in ieee80211_aes_cmac() 2026-03-09 13:27:21 -07:00
aes_gcm.h
aes_gmac.c wifi: mac80211: utilize the newly defined CMAC constants 2025-11-20 11:56:19 +01:00
aes_gmac.h wifi: mac80211: utilize the newly defined CMAC constants 2025-11-20 11:56:19 +01:00
agg-rx.c wifi: mac80211: add support for NDP ADDBA/DELBA for S1G 2026-03-06 10:52:11 +01:00
agg-tx.c wifi: mac80211: allow block ack agreements in NAN Data 2026-04-07 15:36:04 +02:00
airtime.c
cfg.c wifi: mac80211: don't override max_amsdu_subframes 2026-05-20 11:14:41 +02:00
chan.c wifi: mac80211: synchronize valid links for WDS AP_VLAN interfaces 2026-04-07 15:43:02 +02:00
debug.h wifi: mac80211: don't WARN for late channel/color switch 2025-06-17 14:30:06 +02:00
debugfs.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-03-19 14:16:00 -07:00
debugfs.h
debugfs_key.c wifi: mac80211: Clean up debugfs_key deadcode 2025-01-13 13:51:19 +01:00
debugfs_key.h wifi: mac80211: Clean up debugfs_key deadcode 2025-01-13 13:51:19 +01:00
debugfs_netdev.c kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
debugfs_netdev.h
debugfs_sta.c wifi: mac80211: Remove redundant rcu_read_lock/unlock() in spin_lock 2025-09-19 11:48:14 +02:00
debugfs_sta.h
driver-ops.c wifi: mac80211: make monitor link info check more specific 2025-11-11 11:05:19 +01:00
driver-ops.h wifi: mac80211: add NAN peer schedule support 2026-04-07 15:36:03 +02:00
drop.h wifi: mac80211: remove RX_DROP 2026-01-19 10:21:47 +01:00
eht.c wifi: move action code from per-type frame structs 2026-03-06 10:36:26 +01:00
ethtool.c wifi: mac80211: add tx_handlers_drop statistics to ethtool 2025-09-10 15:04:27 +02:00
fils_aead.c wifi: mac80211: Use AES-CMAC library in aes_s2v() 2026-03-09 13:27:21 -07:00
fils_aead.h
he.c wifi: mac80211: support NAN stations 2026-04-07 15:36:03 +02:00
ht.c wifi: mac80211: support NAN stations 2026-04-07 15:36:03 +02:00
ibss.c wifi: mac80211: export ieee80211_calculate_rx_timestamp 2026-04-07 15:36:02 +02:00
ieee80211_i.h wifi: mac80211: update NAN data path state on schedule changes 2026-04-07 15:36:03 +02:00
iface.c wifi: mac80211: enable MLO support for 4-address mode interfaces 2026-04-07 15:43:02 +02:00
Kconfig wifi: mac80211: Use AES-CMAC library in aes_s2v() 2026-03-09 13:27:21 -07:00
key.c wifi: mac80211: Use AES-CMAC library in ieee80211_aes_cmac() 2026-03-09 13:27:21 -07:00
key.h wifi: mac80211: Use AES-CMAC library in ieee80211_aes_cmac() 2026-03-09 13:27:21 -07:00
led.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
led.h
link.c wifi: mac80211: synchronize valid links for WDS AP_VLAN interfaces 2026-04-07 15:43:02 +02:00
main.c wifi: mac80211: run NAN DE code only when appropriate 2026-04-07 15:36:02 +02:00
Makefile wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211 2026-04-08 08:55:15 +02:00
mesh.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-03-19 14:16:00 -07:00
mesh.h
mesh_hwmp.c wifi: move action code from per-type frame structs 2026-03-06 10:36:26 +01:00
mesh_pathtbl.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
mesh_plink.c net: use get_random_u{16,32,64}() where appropriate 2026-04-09 19:27:43 -07:00
mesh_ps.c wifi: mac80211: support parsing S1G TIM PVB 2025-09-04 11:19:01 +02:00
mesh_sync.c wifi: mac80211: export ieee80211_calculate_rx_timestamp 2026-04-07 15:36:02 +02:00
mlme.c wifi: mac80211: consume only present negotiated TTLM maps 2026-05-20 11:20:37 +02:00
nan.c wifi: mac80211: update NAN data path state on schedule changes 2026-04-07 15:36:03 +02:00
ocb.c wifi: mac80211: ocb: skip rx_no_sta when interface is not joined 2025-12-16 10:33:14 +01:00
offchannel.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
parse.c wifi: mac80211: fix multi-link element inheritance 2026-05-20 11:19:53 +02:00
pm.c wifi: cfg80211/mac80211: Add support to get radio index 2025-06-24 15:19:27 +02:00
rate.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
rate.h wifi: mac80211: convert debugfs files to short fops 2024-10-23 16:47:07 +02:00
rc80211_minstrel_ht.c wifi: mac80211: remove unused variables in minstrel_ht_alloc_sta 2026-04-07 15:40:25 +02:00
rc80211_minstrel_ht.h
rc80211_minstrel_ht_debugfs.c [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
rx.c wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb 2026-05-20 11:19:53 +02:00
s1g.c wifi: mac80211: add support for NDP ADDBA/DELBA for S1G 2026-03-06 10:52:11 +01:00
scan.c wifi: mac80211: export ieee80211_calculate_rx_timestamp 2026-04-07 15:36:02 +02:00
spectmgmt.c wifi: move action code from per-type frame structs 2026-03-06 10:36:26 +01:00
sta_info.c wifi: mac80211: update NAN data path state on schedule changes 2026-04-07 15:36:03 +02:00
sta_info.h wifi: mac80211: support NAN stations 2026-04-07 15:36:03 +02:00
status.c wifi: mac80211: Get the correct interface for non-netdev skb status 2025-09-19 11:26:23 +02:00
tdls.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-03-19 14:16:00 -07:00
tkip.c Merge net-next/main to resolve conflicts 2024-10-09 08:59:22 +02:00
tkip.h
trace.c
trace.h wifi: mac80211: add NAN peer schedule support 2026-04-07 15:36:03 +02:00
trace_msg.h
tx.c wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap 2026-06-02 13:26:33 +02:00
uhr.c wifi: mac80211: add initial UHR support 2026-02-02 10:11:08 +01:00
util.c wifi: mac80211: use safe list iteration in radar detect work 2026-05-05 18:07:39 +02:00
vht.c wifi: mac80211: support NAN stations 2026-04-07 15:36:03 +02:00
wbrf.c wifi: mac80211: use cfg80211_chandef_get_width() 2025-03-12 09:50:27 +01:00
wep.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
wep.h
wme.c
wme.h
wpa.c Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
wpa.h wifi: mac80211: refactor CMAC packet handlers 2025-11-20 11:56:19 +01:00