Johannes Berg 48b2c5c628 wifi: cfg80211: check IP header size in cfg80211_classify8021d() ...

A frame that looks like IP can be transmitted, but be too short, so
the DS field is read incorrectly:

  BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027
   cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027
   ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180
   __ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304
   ieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538
   ...
   packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108

Use skb_header_pointer() like the MPLS case.

Assisted-by: LLM
Fixes: e31a16d6f6 ("wireless: move some utility functions from mac80211 to cfg80211")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=878ddc3962f792e9af59
Link: https://patch.msgid.link/20260904165614.5e61a4c80b92.I37d68d3f406cb3b90b32e6943418d66070b65197@changeid
Signed-off-by: Johannes Berg <[email protected]>

2026-09-08 13:09:38 +02:00

..

certs

…

tests

wifi: cfg80211: tests: check BSS lookup failure reasons

2026-07-22 16:11:37 +02:00

.gitignore

…

ap.c

…

chan.c

wifi: cfg80211: remove 5/10 MHz channel support

2026-06-03 14:07:05 +02:00

core.c

wifi: cfg80211: stop PMSR before P2P and NAN teardown

2026-08-02 19:06:33 +02:00

core.h

wifi: cfg80211: convert cookie output to input parameter

2026-08-02 17:40:08 +02:00

debugfs.c

wifi: cfg80211: Add parameters to radio-specific debugfs directories

2025-10-27 09:18:41 +01:00

debugfs.h

…

ethtool.c

wifi: cfg80211: Remove the redundant wiphy_dev

2025-09-10 15:05:48 +02:00

ibss.c

wifi: cfg80211: support key installation on non-netdev wdevs

2026-03-02 11:28:33 +01:00

Kconfig

…

Makefile

wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211

2026-04-08 08:55:15 +02:00

mesh.c

…

michael-mic.c

wifi: cfg80211: Explicitly include <linux/export.h> in michael-mic.c

2026-04-09 08:54:43 +02:00

mlme.c

wifi: cfg80211: convert cookie output to input parameter

2026-08-02 17:40:08 +02:00

nl80211.c

wifi: nl80211: clean up color-change beacon data on errors

2026-08-02 18:23:27 +02:00

nl80211.h

wifi: cfg80211: allow representing NPCA in chandef

2026-05-05 14:49:02 +02:00

ocb.c

…

of.c

wifi: Add SPDX ids to some files in the wireless subsystem

2026-03-06 10:54:23 +01:00

pmsr.c

wifi: cfg80211: publish PMSR request before starting the driver

2026-07-28 15:08:57 +02:00

radiotap.c

wifi: Add SPDX ids to some files in the wireless subsystem

2026-03-06 10:54:23 +01:00

rdev-ops.h

wifi: cfg80211: convert tx_control_port cookie to input parameter

2026-08-02 17:40:08 +02:00

reg.c

wifi: cfg80211: reg: add a newline in DFS debug message

2026-07-22 16:13:38 +02:00

reg.h

wifi: Add SPDX ids to some files in the wireless subsystem

2026-03-06 10:54:23 +01:00

scan.c

Merge tag 'wireless-2026-07-26' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next

2026-07-27 16:03:40 -07:00

sme.c

wifi: cfg80211: use wiphy work for socket owner autodisconnect

2026-07-07 09:27:42 +02:00

sysfs.c

Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2026-04-14 18:36:10 -07:00

sysfs.h

…

trace.c

wifi: Add SPDX ids to some files in the wireless subsystem

2026-03-06 10:54:23 +01:00

trace.h

wifi: nl80211/cfg80211: rename probe_client to probe_peer

2026-07-06 12:45:19 +02:00

util.c

wifi: cfg80211: check IP header size in cfg80211_classify8021d()

2026-09-08 13:09:38 +02:00

wext-compat.c

wifi: cfg80211: clarify and tighten key checks

2026-07-21 19:18:53 +02:00

wext-compat.h

…

wext-core.c

wifi: cfg80211: remove WIPHY_FLAG_DISABLE_WEXT

2026-07-06 12:55:29 +02:00

wext-priv.c

wifi: Add SPDX ids to some files in the wireless subsystem

2026-03-06 10:54:23 +01:00

wext-proc.c

wifi: Add SPDX ids to some files in the wireless subsystem

2026-03-06 10:54:23 +01:00

wext-sme.c

wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()

2026-07-28 15:07:18 +02:00