Commit dc14686f authored by Kartik Nair's avatar Kartik Nair Committed by Johannes Berg
Browse files

wifi: cfg80211: wext: validate chandef in monitor mode 



cfg80211_wext_siwfreq() constructs a channel definition for monitor
mode but passes it to cfg80211_set_monitor_channel() without first
validating it with cfg80211_chandef_valid(). This causes a WARN_ON
in cfg80211_chandef_dfs_required() when it receives an invalid chandef.

Add the missing cfg80211_chandef_valid() check before calling
cfg80211_set_monitor_channel() to return -EINVAL early on invalid
channel definitions, consistent with how other callers handle this.

Reported-by: default avatar <syzbot+02a1a03b8622d3c7d1c9@syzkaller.appspotmail.com>
Signed-off-by: default avatarKartik Nair <contact.kartikn@gmail.com>
Link: https://patch.msgid.link/20260510202437.7857-1-contact.kartikn@gmail.com


[clarify subject]
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 8499d094

net/wireless/wext-compat.c

+2 −0
Original line number Diff line number Diff line
@@ -789,6 +789,8 @@ static int cfg80211_wext_siwfreq(struct net_device *dev, 
		chandef.chan = ieee80211_get_channel(&rdev->wiphy, freq);

		if (!chandef.chan)

			return -EINVAL;

		if (!cfg80211_chandef_valid(&chandef))

			return -EINVAL;

		return cfg80211_set_monitor_channel(rdev, dev, &chandef);

	case NL80211_IFTYPE_MESH_POINT:

		freq = cfg80211_wext_freq(wextfreq);