<div><div>Yes, I'm sorry, my mistake, I'll send the 3rd version now.</div></div><div><br /></div><div><br /></div><div style="background-color:rgb( 253 , 252 , 250 );color:rgb( 0 , 0 , 0 );font-family:'arial' , 'helvetica' , sans-serif;font-size:16px;font-style:normal;font-weight:400;text-align:start;text-decoration-color:initial;text-decoration-line:none;text-decoration-style:initial;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">-- </div><div style="background-color:rgb( 253 , 252 , 250 );color:rgb( 0 , 0 , 0 );font-family:'arial' , 'helvetica' , sans-serif;font-size:16px;font-style:normal;font-weight:400;text-align:start;text-decoration-color:initial;text-decoration-line:none;text-decoration-style:initial;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">С уважением, Лобанов Михаил <br />АО "НТЦ ИТ РОСА"<br />Специалист отдела по информационной безопасности<br /><br />e-mail: <span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><a href="mailto:m.lobanov@rosalinux.ru" rel="noopener noreferrer" target="_blank">m.lobanov@rosa.ru</a></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span><br />тел.: <span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><a href="callto:+7-919-202-64-36" rel="noopener noreferrer" target="_blank" style="color:rgb( 51 , 102 , 153 );text-decoration:none">+7-919-202-64-36</a></span><br /><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><span style="color:rgb( 51 , 102 , 153 );text-decoration:none"><a href="http://www.rosa.ru/" rel="noopener noreferrer" target="_blank" style="color:rgb( 51 , 102 , 153 );text-decoration:none">http://www.rosa.ru</a></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></div><div><br /></div><div><br /></div><div><br /></div><div>----------------</div>
<div>Кому: m.lobanov@rosa.ru (m.lobanov@rosa.ru);<br /></div>
<div>Копия: johannes@sipsolutions.net, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, lvc-project@linuxtesting.org, shaul.triebitz@intel.com;<br /></div>
<div>Тема: [PATCH v2] wifi: mac80211: check basic rates validity in sta_link_apply_parameters;<br /></div>
<div>15.03.2025, 18:20, "Christophe JAILLET" <christophe.jaillet@wanadoo.fr>:<br /></div>
<blockquote><p>Le 15/03/2025 à 14:01, Mikhail Lobanov a écrit :<br /></p><blockquote class="210e7a848e8fcb45wmi-quote"> When userspace sets supported rates for a new station via<br /> NL80211_CMD_NEW_STATION, it might send a list that's empty<br /> or contains only invalid values. Currently, we process these<br /> values in sta_link_apply_parameters() without checking the result of<br /> ieee80211_parse_bitrates(), which can lead to an empty rates bitmap.<br /> <br /> A similar issue was addressed for NL80211_CMD_SET_BSS in commit<br /> ce04abc3fcc6 ("wifi: mac80211: check basic rates validity").<br /> This patch applies the same approach in sta_link_apply_parameters()<br /> for NL80211_CMD_NEW_STATION, ensuring there is at least one valid<br /> rate by inspecting the result of ieee80211_parse_bitrates().<br /> <br /> Found by Linux Verification Center (linuxtesting.org) with Syzkaller.<br /> <br /> Fixes: b95eb7f0eee4 ("wifi: cfg80211/mac80211: separate link params from station params")<br /> Signed-off-by: Mikhail Lobanov <<a href="mailto:m.lobanov-kcSV9N6+iMo@public.gmane.org">m.lobanov-kcSV9N6+iMo@public.gmane.org</a>><br /> ---<br /> v2: Fixed the patch subject to provide a complete description.<br /> <br /> net/mac80211/cfg.c | 5 +++--<br /> 1 file changed, 3 insertions(+), 2 deletions(-)<br /> <br /> diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c<br /> index 9351c64608a9..e7c429aef<span class="1f1ea193f6735cf0wmi-callto">980 100644</span><br /> --- a/net/mac80211/cfg.c<br /> +++ b/net/mac80211/cfg.c<br /> @@ -1909,10 +1909,11 @@ static int sta_link_apply_parameters(struct ieee80211_local *local,<br /> <br /> if (params->supported_rates &&<br /> params->supported_rates_len) {<!-- --><br /> - ieee80211_parse_bitrates(link->conf->chanreq.oper.width,<br /> + (!ieee80211_parse_bitrates(link->conf->chanreq.oper.width,<br /></blockquote><p><br />'if" missing?<br /><br /></p><blockquote class="210e7a848e8fcb45wmi-quote"> sband, params->supported_rates,<br /> params->supported_rates_len,<br /> - &link_sta->pub->supp_rates[sband->band]);<br /> + &link_sta->pub->supp_rates[sband->band]))<br /> + return -EINVAL;<br /> }<br /> <br /> if (params->ht_capa)<br /></blockquote><p><br /></p></blockquote>