From bc6ee3fc1a2ba10a3d62189c9548bfc43b3d2b36 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Tue, 25 Feb 2025 22:59:22 +0900 Subject: [PATCH] wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower BugLink: https://bugs.launchpad.net/bugs/2099996 commit 393b6bc174b0dd21bb2a36c13b36e62fc3474a23 upstream. Avoid potentially crashing in the driver because of uninitialized private data Fixes: 5b3dc42b1b0d ("mac80211: add support for driver tx power reporting") Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Link: https://patch.msgid.link/20241002095630.22431-1-nbd@nbd.name Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman CVE-2024-50237 Signed-off-by: Koichiro Den Signed-off-by: Stefan Bader --- net/mac80211/cfg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index 0534150f6f6f..d2854fbfcb69 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -3080,7 +3080,8 @@ static int ieee80211_get_tx_power(struct wiphy *wiphy, struct ieee80211_local *local = wiphy_priv(wiphy); struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); - if (local->ops->get_txpower) + if (local->ops->get_txpower && + (sdata->flags & IEEE80211_SDATA_IN_DRIVER)) return drv_get_txpower(local, sdata, dbm); if (!local->use_chanctx)