From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm2-f0.google.com (mail-wm2-f0.google.com [74.125.225.128]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CFF8A3803EB for ; Fri, 26 Jun 2026 11:12:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.225.128 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782472328; cv=none; b=C6cqJf+SOAdd4d12gnCBjvWvqtW0O6BWKTQxL1hMMqNewl9J16NacksMDP/VEEyVPCjiJ/ycZAOiYgXcfH5++GyRU3LvPDiGUK5oF2FuhqdQY6ke0FrLfx8fAaP66mIR2xrzB1GKcoWcOkbsPgvhBiMCRojL31UVHvWuuk1Kmgg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782472328; c=relaxed/simple; bh=+Msa4E+bz5dtBLHnYKgrFLPtkbZd5C0/STBltE5z0Ec=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=HmkyOu6073Y7Dgt41j0Vv/uL1meERp9fauvKZEva5U+TYRz7x9X2Hbe15/zdNqg+no1ZLlxG1iBFgmGirTvYrVYl7X5Q0SoHmKd4Kk7bZNWqoZ5CAmMSrVTr3FL6jv6YwjXJx1w5JcZjtyowvBShHKPwbgOLEOTVwi2o7UuGN/w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Y8ofQI0j; arc=none smtp.client-ip=74.125.225.128 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Y8ofQI0j" Received: by mail-wm2-f0.google.com with SMTP id 5b1f17b1804b1-49247052d8aso113815e9.0 for ; Fri, 26 Jun 2026 04:12:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782472325; x=1783077125; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=V6cKfkRrepHIUsrrBVwXQjNxoni88MPu9YukKZzg9ig=; b=Y8ofQI0j0OQ6W7NxJHexms/aDHe705eDVhSvZBgra69Hs9ux4l2WkgeRkNEHsKC0c4 0o3EwzMDmuxuQtDDMW3rvAP4BmT01h1lI7ZiKyZWYsjmFfuoZuV+a6K5zadB1xgQgUOq lCc0+NlDYokK94W8SjNENm8IILBi5M7oHf1x8TIfnkMzmH86SXNphL7oMJyTN4ZsjiEw uTNN94uxICfDAMTupAzkScySnEp/lb3vsZtmCFK3fonqhxZxxsMuCIMasxOmsqaaO/L3 tZ0ZSRl0JCYk4U+bzSog7hcWackRZgFiuzR64xSikBkErONwhNYcsG/401tydEZ29cLf 36CA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782472325; x=1783077125; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=V6cKfkRrepHIUsrrBVwXQjNxoni88MPu9YukKZzg9ig=; b=D/mtTngwR58QMIrKs8hrBW3QodXY06X91CQ1u/Xc+vJP3pUMadUq+mmbB3ssFmetOl 3hPvhl5A5ogd+yRWrYQU1XbqN4GOhCqB8LZ2KSLJZO8EVn75L+3DPpkars1DkA2ChIBO Gli3O0RSyYCAg+HyFzNJOaQAyuuru2tLu+UoUDRTfANiOAfeJ2yRS6hIjDWEb29fdPKk z83YmiaWIVcPLGbn4Li/hk+D7P6FS5CKlpOK+hDQvLe1EHVxt1tpDmjS7Tb7zL9Zi7XO ZsZQ2uHXnOK/NJ7EIuX1q3APuBYuO7LL6wBhhJy2CGfTsJeCJ3a3y+RYWPdHcmhKKF1p Oxdg== X-Forwarded-Encrypted: i=1; AFNElJ+3HjHehjQKDD3r/6kMpAums2jc9BWjMvAxrQrS9dUVjKIyEaI9M1dS2ZrpR130BODhD2maqBJJ84az+hg=@vger.kernel.org X-Gm-Message-State: AOJu0YyETpmINdx70YL4cijw/Q4PN2fVH296lbBbW1hEI8+tFpCKICEM LDoahe18J2kTtPhI8UJoI1MZvq5PiNG/9rMSBDdGKOINr9yAXcCwchbe X-Gm-Gg: AfdE7cl8VcCFUm7QPtEf+Nh10kfTw3jhV+pqkPq6MSKQWWfZ2jpYzOropzdvMyYusoE q7ns6RkEOOuuiMtYehAlR6hEwbY68ouO/aYjYgfPjFuZYMKLMRtwXSLOGZeJAwDkdivRaUQtUhE ct7pvQQJcZyqRJBqav2SAjSDW2aA7h7PHI2jJihTNTD1LogLvCC8/RxBftqLNHpMpEUwl/hjpx4 bjBlZ4+JyWNnujPlTiqgIf95yylPGfoVkt6tZwTm7hvR5qjJFhpphmsJB4D9PbjozaEieNU8ftS 9pwXlZ8Qgjz0u1NDIZS10VhOaLnt34mlI1OoB6lJuqXqwAbJ1tGvXS73e9yMyxsykf+AJkenCLB S40qF/r6695TcZwXFX2R7xPmZKHnttTNrcQb/J3ThKXwHL4aa/cg7vDKrdF0wu2U0Caa0AnV0+9 K1mxq15yf5JTY= X-Received: by 2002:a05:600c:4e0b:b0:490:44eb:c1ea with SMTP id 5b1f17b1804b1-4926fc78e30mr4843235e9.24.1782472325018; Fri, 26 Jun 2026 04:12:05 -0700 (PDT) Received: from fedora ([212.253.209.56]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4926c28673dsm43659175e9.2.2026.06.26.04.12.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Jun 2026 04:12:04 -0700 (PDT) From: Serhat Kumral To: Johannes Berg , linux-wireless@vger.kernel.org Cc: Benjamin Berg , Miri Korenblit , linux-kernel@vger.kernel.org, syzbot+21629c14aa749636db9d@syzkaller.appspotmail.com, Serhat Kumral Subject: [PATCH wireless] wifi: mac80211_hwsim: avoid division by zero in mac80211_hwsim_write_tsf() Date: Fri, 26 Jun 2026 00:56:06 +0300 Message-ID: <20260625215606.11049-1-serhatkumral1@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit mac80211_hwsim_write_tsf() adjusts the timestamp of beacon, probe response and S1G beacon frames by dividing a constant by the legacy bitrate of the selected tx rate, e.g.: mgmt->u.probe_resp.timestamp = cpu_to_le64(sim_time + data->tsf_offset + 24 * 8 * 10 / bitrate); bitrate is taken from ieee80211_get_tx_rate(), which indexes the band's legacy bitrates[] table by control.rates[0].idx without checking the HT/VHT/S1G MCS flags or the table bounds. For an MCS rate the idx is not a legacy-rate index, so the returned rate can have a bitrate of 0. The code only guarded against a NULL rate, not a zero bitrate, so the division can divide by zero. As the call trace shows, this is reachable from user space by injecting a frame on a monitor interface: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:mac80211_hwsim_write_tsf+0x3a3/0x590 Call Trace: mac80211_hwsim_tx_frame_no_nl+0x16b/0x1760 mac80211_hwsim_tx+0x1784/0x2500 ieee80211_tx_frags+0x3df/0x890 ieee80211_monitor_start_xmit+0xb33/0x1280 __dev_queue_xmit+0x1435/0x37f0 packet_sendmsg+0x3d95/0x5040 Fixing this in ieee80211_get_tx_rate() is not viable: callers such as ath5k and adm8211 dereference its return value without a NULL check, so making it return NULL for MCS rates would only move the crash elsewhere. Keep the fix local and fall back to the existing default of 100 whenever the reported bitrate is zero, in line with the existing "/* TODO: get MCS */" note above. Fixes: e75129031f1c ("wifi: mac80211_hwsim: move timestamp writing later in the datapath") Reported-by: syzbot+21629c14aa749636db9d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=21629c14aa749636db9d Signed-off-by: Serhat Kumral --- drivers/net/wireless/virtual/mac80211_hwsim_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c index 0dd8a6c85953..c745395d2042 100644 --- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c +++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c @@ -1604,7 +1604,7 @@ static void mac80211_hwsim_write_tsf(struct mac80211_hwsim_data *data, spin_lock_bh(&data->tsf_offset_lock); txrate = ieee80211_get_tx_rate(data->hw, info); - if (txrate) + if (txrate && txrate->bitrate) bitrate = txrate->bitrate; if (skb->len >= offsetofend(typeof(*mgmt), u.probe_resp.timestamp) && -- 2.54.0