linux-kernel - [PATCH] wifi: mac80211: fix NULL pointer dereference in ieee80211_mesh_build

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20260119150031.201832-1-aha310510@gmail.com>
Date: Tue, 20 Jan 2026 00:00:31 +0900
From: Jeongjun Park <aha310510@...il.com>
To: Johannes Berg <johannes@...solutions.net>
Cc: linux-wireless@...r.kernel.org,
	syzbot+81cd9dc1596563141d19@...kaller.appspotmail.com,
	linux-kernel@...r.kernel.org,
	Jeongjun Park <aha310510@...il.com>
Subject: [PATCH] wifi: mac80211: fix NULL pointer dereference in ieee80211_mesh_build_beacon()

NULL pointer dereference bug occurs because ieee80211_mesh_build_beacon()
does not check the return value of ieee80211_get_sband().

Therefore, we need to add a return value check to prevent this.

Reported-by: syzbot+81cd9dc1596563141d19@...kaller.appspotmail.com
Closes: https://lore.kernel.org/all/696e34bf.a70a0220.34546f.04ad.GAE@google.com/
Fixes: 147ceae20534 ("wifi: mac80211: simplify adding supported rates")
Signed-off-by: Jeongjun Park <aha310510@...il.com>
---
 net/mac80211/mesh.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 68901f1def0d..eb3a346226bd 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -964,6 +964,8 @@ ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
 	sdata = container_of(ifmsh, struct ieee80211_sub_if_data, u.mesh);
 
 	sband = ieee80211_get_sband(sdata);
+	if (!sband)
+		return -EINVAL;
 
 	ie_len_he_cap = ieee80211_ie_len_he_cap(sdata);
 	ie_len_eht_cap = ieee80211_ie_len_eht_cap(sdata);
--