From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0879513B293 for ; Thu, 5 Feb 2026 03:52:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770263563; cv=none; b=ng71FuIfwKz+3sd7GEcsRGtIkvw4GmmST5B8TKL8wniYhdFZHGwgl/NGbEkEtnt/mcLghOmKPnlHkvX36Ytq9hTIihNXV3ve9D9NnjX4BbeB15pWDwO31hECHPBat1COmV6OOZGJEMccpi2U/Y1CCNFN5jVQN2G22xVmOy8WBoc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770263563; c=relaxed/simple; bh=he/euZIb+7nGDowd6ofIEKauu0OYEXlKSqHjuCdgq2I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=SmSi4o7F5NW8oN3dBx5QCgJ/ULy2dSIWspP6TuWX3hzBWjM+MCYjWCSfQzKz7n8Sb8rEJezGR0T8g9m9d6kdB/pfXlRVCDtv23IxI+O3IeK1hqahUUgzAtJw2tWBfPWlM04JzkZ0FgcUYpokBT2K7E5Xb3EWbknjEWA4qPtDAJo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Qu26q0Go; arc=none smtp.client-ip=209.85.210.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Qu26q0Go" Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-823081bb15fso296821b3a.3 for ; Wed, 04 Feb 2026 19:52:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1770263562; x=1770868362; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=v+kdKXzJ6z8gg3py8m3rnJr90/PdPYODZxYKzc7gJDw=; b=Qu26q0Gov3tSLkc41cxFkh2rskN0jjXMWgoOAtc2cVnH2Slx9eL5yrOU7ZQyIWyyYw /CPtk0zVd/rNePQ5JVsafFJiDbllWqXvpgJA8hA0oZqW2Yz4Dak1PyArzcWappQZ+CkG fqXKuNQ8+zbSFbpasIJ5EGXa9sNOhR2Cc6LJGYxrmKXQ0YuAqToTn2xoxUVnJbSHYl7d +LZagpdCmfjOZBXihnwWy8P+oJ4anhPT+yG6T5wm7II0Je5vP9/PAag8qWoVJaTOMJKP KWGt9wK0rk28rMjf10+Ga+cJWlC2cpJCJr7okrS29u6PFewdEaC7r4c71rxbFXHLtkGJ zUVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770263562; x=1770868362; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=v+kdKXzJ6z8gg3py8m3rnJr90/PdPYODZxYKzc7gJDw=; b=le6YEe4KuRDkxA5KySwWXeoXEGxo9+u497RS31eT6j/Ca7A7nnxG5Djf33JkMCi9NM CFsXdwwOOfd3RqJpe3kvigW+Af2MJ4i09rCUHZ9pAJGIN96Zoe1N3WuVvy3pqgJEWJRb cHn5+4xlY37EAzoTPv2C7bqkhV1qOzIyzobtun0bGDtS/GdNy3SJLRaFusMMF2hMTx76 pSNc2EIgy9bJRn/wDgZPWs2rFPHx9Q2mYKCvFM8G3E1cc4W7pC3DJ31j1+DGn+ZK1Hrq o6QEFcBXmftbEI52KjKK/vKIuO4CliTATNbC/ITm8NHBWXUT4aSWtb++utZD1vJbJaUy 2FtQ== X-Forwarded-Encrypted: i=1; AJvYcCVC24i3lpaYwAP3X0+2KHMC3ucKi8cNpTig0HcgF49xPAFmcRjHhhflH9qHi9z+sIhYSjMgmL3WDN5k3ZM=@vger.kernel.org X-Gm-Message-State: AOJu0YxfbC9geG35OESvalkz5k+CVB9LIc/SU0xfrLET7R8L7ycGcBxh KAbgn5Gwr4/oaY+j3CNXaV2nmnVOAdb55ZyC+/v0sUPXPpezKzlKt9hz X-Gm-Gg: AZuq6aIKEm7MX+UNQikVqPyuTu2Nj2K2kIHrtrrp89WO3fNsT7/SWTn2+4TAP0IAHLI 58CbPeLRpW7VzZezDSAYBq9r36pyBGCSuk+J/MuPNNPAAj6dVZj3P2qeOFIEj8NzHfZXUYdsFFM hS75mOAkYupT9xg6gr2fqI7n+NZy1x5qhwNvRzFIq7p8U1R9SXr0zKa8tkVjFSr2mangsCRTKHO KKB/9Sqf70War/Yyr0XePu3Y2naJZ7noudHsVLFVHvSXuL2b3fZ6M/R0CRvUvy4A9EczavDjlBb KIUfoavcBveICVEXfqZvdb93IG0PCTCsMUylqb6vgTS7YOSHLUjFeFPnRfRaURW0yWOGRIwt/dd w+TQ8HkE5sBZ1wymRki6+pVlQM8k3iRVMxMA0rp33D5LdQr50K5k+gufjS7NIQgO5RNV7mYUVWL xcZsGw7Pn0vLg= X-Received: by 2002:a05:6a00:3d54:b0:81f:44f9:7c1a with SMTP id d2e1a72fcca58-8241c188060mr5723484b3a.3.1770263562235; Wed, 04 Feb 2026 19:52:42 -0800 (PST) Received: from mint.. ([2401:4900:7925:4bf8:455e:d5c9:a17:3da7]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8241d435319sm4018523b3a.33.2026.02.04.19.52.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Feb 2026 19:52:41 -0800 (PST) From: Dhyan K Prajapati To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Dhyan K Prajapati Subject: [PATCH] mac80211: fix NULL pointer dereference when switching to monitor mode Date: Thu, 5 Feb 2026 09:22:23 +0530 Message-ID: <20260205035223.20411-1-dhyan19022009@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When switching an interface to monitor mode, ieee80211_link_info_change_notify() incorrectly sends BSS change notifications to drivers, even though monitor interfaces have no associated BSS context. This causes NULL pointer dereferences in drivers like iwldvm. The bug occurs because the current code only returns early for monitor interfaces when WANT_MONITOR_VIF is NOT set. When WANT_MONITOR_VIF IS set, execution breaks from the switch statement and falls through to drv_link_info_changed(), which triggers the crash when the driver attempts to dereference link->conf->bss. Crash trace: RIP: iwlagn_bss_info_changed+0x19d/0x640 [iwldvm] Code: 49 8b 46 10 <8b> 10 RAX: 0000000000000000 (NULL link->conf->bss) Fix by unconditionally returning early for IFTYPE_MONITOR, consistent with IFTYPE_AP_VLAN handling. Also simplify by merging both cases. Device: Intel Centrino Advanced-N 6205 Signed-off-by: Dhyan K Prajapati --- net/mac80211/main.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/net/mac80211/main.c b/net/mac80211/main.c index b05e313c7..bc93df21e 100644 --- a/net/mac80211/main.c +++ b/net/mac80211/main.c @@ -412,11 +412,8 @@ void ieee80211_link_info_change_notify(struct ieee80211_sub_if_data *sdata, switch (sdata->vif.type) { case NL80211_IFTYPE_AP_VLAN: - return; case NL80211_IFTYPE_MONITOR: - if (!ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF)) - return; - break; + return; default: break; } -- 2.43.0