linux-kernel - Re: [PATCH wireless-next] wifi: mac80211: reject VHT opmode for unsupported channel widths

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1f13328a55c54fb49d8ca1dd72bc5de23f161ac8.camel@sipsolutions.net>
Date: Thu, 03 Jul 2025 17:09:45 +0200
From: Johannes Berg <johannes@...solutions.net>
To: Moonhee Lee <moonhee.lee.ca@...il.com>, Nicolas Escande
	 <nico.escande@...il.com>
Cc: linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org, 
	linux-kernel-mentees@...ts.linux.dev, 
	syzbot+ededba317ddeca8b3f08@...kaller.appspotmail.com
Subject: Re: [PATCH wireless-next] wifi: mac80211: reject VHT opmode for
 unsupported channel widths

On Thu, 2025-07-03 at 02:02 -0700, Moonhee Lee wrote:
> Hi Nicolas,
> 
> On Thu, Jul 3, 2025 at 1:12 AM Nicolas Escande <nico.escande@...il.com> wrote:
> 
> > Is this really specific for VHT ? or for HE /EHT as well ?
> > 
> > > +             switch (width) {
> > > +             case NL80211_CHAN_WIDTH_20_NOHT:
> > Because this seems weird for VHT
> > > +             case NL80211_CHAN_WIDTH_320:
> > And this did not exist for VHT either

Yes, but see below.

> 
> Thanks for the feedback. The intention was to handle VHT opmode notifications,
> as noted in the commit message, but the check incorrectly included widths that
> are not valid for VHT, such as 20_NOHT and 320. I will update v2 to reject any
> invalid widths, not just 5 or 10 MHz, and restrict the check to the valid set
> for VHT: 20, 40, 80, 160, and 80+80.

I'm not entirely sure that'd be correct. 320 MHz can only be used on the
6 GHz band, so clients must be at least HE, but I'm not sure that VHT
opmode notification frames are completely illegal for them, even if
they'd like use OMI instead.

How did syzbot even manage to get a 10 MHz thing running though?

johannes