diff options
| author | Ping-Ke Shih <pkshih@realtek.com> | 2026-05-06 21:10:00 +0800 |
|---|---|---|
| committer | Ping-Ke Shih <pkshih@realtek.com> | 2026-05-13 11:43:56 +0800 |
| commit | f77199a0cf6660d45d72010e76c3ab4788e9da5f (patch) | |
| tree | c0a4e8ba2c3b935e06487ddf46c4e96076a5bb60 | |
| parent | 0805ddc2fdb64c142eb2be8429497dfd8c9bf296 (diff) | |
wifi: rtw89: check skb headroom before adding radiotap
The radiotap headroom is allocated only if IEEE80211_CONF_MONITOR is set.
However, it is potentially racing that SKB allocation without radiotap
headroom but adding radiotap from matched PPDU status of another SKB.
Add a check to avoid the case.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260506131000.1706298-15-pkshih@realtek.com
| -rw-r--r-- | drivers/net/wireless/realtek/rtw89/core.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index c21737981b61..432d46dfd26a 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -3758,6 +3758,13 @@ static void rtw89_core_update_radiotap(struct rtw89_dev *rtwdev, if (!(rtwdev->hw->conf.flags & IEEE80211_CONF_MONITOR)) return; + /* + * At transient adding a monitor vif from a station vif, the headroom + * might not include radiotap. + */ + if (unlikely(skb_headroom(skb) < RTW89_RADIOTAP_ROOM + NET_SKB_PAD)) + return; + if (rx_status->encoding == RX_ENC_VHT) rtw89_core_update_radiotap_vht(rtwdev, skb, rx_status, phy_ppdu); else if (rx_status->encoding == RX_ENC_HE) |