Vitaliy Shevtsov cd1bdcb77f wifi: nl80211: reject cooked mode if it is set along with other flags ... commit 49f27f2944 upstream. It is possible to set both MONITOR_FLAG_COOK_FRAMES and MONITOR_FLAG_ACTIVE flags simultaneously on the same monitor interface from the userspace. This causes a sub-interface to be created with no IEEE80211_SDATA_IN_DRIVER bit set because the monitor interface is in the cooked state and it takes precedence over all other states. When the interface is then being deleted the kernel calls WARN_ONCE() from check_sdata_in_driver() because of missing that bit. Fix this by rejecting MONITOR_FLAG_COOK_FRAMES if it is set along with other flags. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 66f7ac50ed ("nl80211: Add monitor interface configuration flags") Cc: stable@vger.kernel.org Reported-by: syzbot+2e5c1e55b9e5c28a3da7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2e5c1e55b9e5c28a3da7 Signed-off-by: Vitaliy Shevtsov <v.shevtsov@mt-integration.ru> Link: https://patch.msgid.link/20250131152657.5606-1-v.shevtsov@mt-integration.ru Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-03-13 12:51:03 +01:00
..
certs	wifi: cfg80211: fix certs build to not depend on file order	2024-01-05 15:13:33 +01:00
.gitignore
ap.c
chan.c
core.c	wifi: cfg80211: lock wiphy mutex for rfkill poll	2024-01-25 14:52:27 -08:00
core.h	Revert "wifi: cfg80211: check wiphy mutex is held for wdev mutex"	2024-10-17 15:10:41 +02:00
debugfs.c
debugfs.h
ethtool.c
ibss.c
Kconfig
lib80211_crypt_ccmp.c
lib80211_crypt_tkip.c
lib80211_crypt_wep.c
lib80211.c
Makefile
mesh.c
mlme.c
nl80211.c	wifi: nl80211: reject cooked mode if it is set along with other flags	2025-03-13 12:51:03 +01:00
nl80211.h
ocb.c
of.c
pmsr.c	wifi: cfg80211: pmsr: use correct nla_get_uX functions	2024-07-05 09:14:05 +02:00
radiotap.c
rdev-ops.h
reg.c	wifi: cfg80211: regulatory: improve invalid hints checking	2025-03-13 12:51:02 +01:00
reg.h
scan.c	wifi: cfg80211: adjust allocation of colocated AP data	2025-03-13 12:49:58 +01:00
sme.c	wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors	2024-10-17 15:10:45 +02:00
sysfs.c
sysfs.h
trace.c
trace.h	wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class	2024-06-16 13:39:13 +02:00
util.c	wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()	2024-08-19 05:44:57 +02:00
wext-compat.c
wext-compat.h
wext-core.c	wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()	2024-03-01 13:21:55 +01:00
wext-priv.c
wext-proc.c
wext-sme.c
wext-spy.c