diff options
| author | Yousef Alhouseen <alhouseenyousef@gmail.com> | 2026-06-28 02:25:37 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-07-06 14:11:07 +0200 |
| commit | 23b493d9dc5f00bba59347bd8ec7b044e26392a0 (patch) | |
| tree | e9ea58622d441f2deb3e39e43810c83ff2a16c31 /tools/perf/scripts/python/bin/stackcollapse-record | |
| parent | 63c2391deefb31e1b801b7f32bd502ca4808639b (diff) | |
wifi: mac80211_hwsim: avoid treating MCS as legacy rate index
Injected HT and VHT rates store an MCS value in rates[0].idx rather
than an index into the legacy bitrate table. hwsim nevertheless passes
these rates to ieee80211_get_tx_rate() while generating monitor frames
and timestamps.
A crafted injected frame can therefore read beyond the bitrate table.
If the resulting bitrate is zero, mac80211_hwsim_write_tsf() also
divides by zero, as observed by syzbot.
Use ieee80211_get_tx_rate() only for legacy rates. The existing fallback
continues to supply a conservative bitrate where hwsim does not yet
calculate MCS rates.
Reported-by: syzbot+21629c14aa749636db9d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=21629c14aa749636db9d
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260628002537.23550-1-alhouseenyousef@gmail.com
[drop wrong Fixes tag]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'tools/perf/scripts/python/bin/stackcollapse-record')
0 files changed, 0 insertions, 0 deletions