linux.git/drivers/net/wireless/virtual/mac80211_hwsim_main.c, branch master

wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO

2026-07-21T12:09:21Z

hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally reads IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds the attribute from above (NLA_BINARY .len is a maximum) and the op sets GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is accepted and the loop reads past the payload. Require the exact length in the policy, so a malformed attribute is rejected before the handler runs. Signed-off-by: Ibrahim Hashimov Assisted-by: AuditCode-AI:2026.07 Link: https://patch.msgid.link/20260721115346.17236-1-security@auditcode.ai Signed-off-by: Johannes Berg

wifi: mac80211_hwsim: avoid treating MCS as legacy rate index

2026-07-06T12:11:07Z

Injected HT and VHT rates store an MCS value in rates[0].idx rather than an index into the legacy bitrate table. hwsim nevertheless passes these rates to ieee80211_get_tx_rate() while generating monitor frames and timestamps. A crafted injected frame can therefore read beyond the bitrate table. If the resulting bitrate is zero, mac80211_hwsim_write_tsf() also divides by zero, as observed by syzbot. Use ieee80211_get_tx_rate() only for legacy rates. The existing fallback continues to supply a conservative bitrate where hwsim does not yet calculate MCS rates. Reported-by: syzbot+21629c14aa749636db9d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=21629c14aa749636db9d Signed-off-by: Yousef Alhouseen Link: https://patch.msgid.link/20260628002537.23550-1-alhouseenyousef@gmail.com [drop wrong Fixes tag] Signed-off-by: Johannes Berg

wifi: mac80211_hwsim: clamp virtio RX length before skb_put

2026-07-06T12:11:06Z

hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skb_put() past the buffer end and hits skb_over_panic() -- a host-triggerable guest panic (denial of service). Clamp the length to the skb's available room before skb_put(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length/header checks in hwsim_virtio_handle_cmd() and is dropped, so truncating rather than dropping here cannot be turned into a parsing problem. Fixes: 5d44fe7c9808 ("mac80211_hwsim: add frame transmission support over virtio") Signed-off-by: Bryam Vargas Link: https://patch.msgid.link/20260620-b4-disp-474bee37-v1-1-1a4d37f3e2d4@proton.me Signed-off-by: Johannes Berg

wifi: mac80211_hwsim: claim DBE capability

2026-06-03T12:11:59Z

Claim DBE capability in UHR MAC capabilities, hostapd will have to sort out the actual DBE capabilities based on the EHT capabilities. Link: https://patch.msgid.link/20260529102644.4db84674e8c2.I8731be8ea589c94ece5623e7e716cbbc03f50466@changeid Signed-off-by: Johannes Berg

wifi: Update UHR PHY capabilities to D1.4

2026-06-03T12:11:58Z

There are new capabilities in D1.4, and some reserved bits. Update the code accordingly. Link: https://patch.msgid.link/20260529102644.f146932b21e2.I12bad84157bf809fbe285b79420143b3c456d9d2@changeid Signed-off-by: Johannes Berg

wifi: cfg80211: remove 5/10 MHz channel support

2026-06-03T12:07:05Z

Remove WIPHY_FLAG_SUPPORTS_5_10_MHZ and 5/10 MHz channel width support. We contemplated this back in early 2023 and didn't do it yet, but nobody stepped up to maintain it. It's already _mostly_ dead code since it can really only be used for AP and maybe IBSS and monitor, but not on a client since there's no way to scan (and hasn't been in a very long time, if ever), so the only thing that ever could really happen with it was run syzbot and trip over assumptions in the code. Signed-off-by: Johannes Berg Reviewed-by: Lachlan Hodges Link: https://patch.msgid.link/20260529084502.080c5885f0b7.I77cc94485b523c3c006005b9233db13cd4e077b3@changeid Signed-off-by: Johannes Berg

wifi: mac80211_hwsim: add debug messages for link changes

2026-05-28T07:50:06Z

It's useful to be able to see the link addresses when the interface links change, so add some prints to hwsim for the vif link change callback. Signed-off-by: Johannes Berg Reviewed-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260527224151.b22a048abc7c.Ief2132c5c4bb67fa56e90eb8e7d59dfd9f2b9378@changeid Signed-off-by: Johannes Berg

wifi: mac80211_hwsim: modernise S1G channel list

2026-05-28T07:48:15Z

The current S1G channel list in mac80211_hwsim does not represent what S1G drivers would advertise that being 1MHz primaries. Also, include the NO_PRIMARY flag on the edgeband 1MHz primaries to emulate US operation such that it can also be tested. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20260527033828.183821-3-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg

wifi: mac80211_hwsim: don't run RC update on new STA on S1G vif

2026-05-28T07:48:15Z

mac80211_hwsim_sta_rc_update() is unable to handle S1G widths so when a new STA is added under a S1G vif the WARN is hit preventing hwsim use for S1G. For now, skip calling rc_update() for S1G interfaces. This is required such that the soon-to-be S1G hwsim tests can successfully run. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20260527033828.183821-2-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg

wifi: mac80211_hwsim: Do not declare NAN support for Extended Key ID

2026-05-20T10:03:28Z

Do not declare support for Extended Key ID for NAN, as defined in section 7.4 in the WiFi Aware specification v4.0 (in order to support security association upgrade). Fixes: eaa7ce66c3e2 ("wifi: mac80211_hwsim: Fix possible NULL dereference") Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260515141442.365ca3ab29f9.Ib435168dcc1d7d8719a5612109035ca1950967ed@changeid Signed-off-by: Johannes Berg