syzbot reports a NULL/invalid pointer dereference in trace_event_raw_event_drv_net_setup_tc(), reached via ieee80211_netdev_setup_tc() -> drv_net_setup_tc(). drv_net_setup_tc() calls get_bss_sdata(sdata) unconditionally. For an NL80211_IFTYPE_AP_VLAN interface this does container_of(sdata->bss, ...), but sdata->bss is only linked opportunistically at interface-add time when a matching same-address AP interface exists - it is not enforced, so an AP_VLAN interface can be fully created and registered with sdata->bss left NULL. container_of() on NULL yields a small invalid pointer rather than NULL, which the trace_drv_net_setup_tc tracepoint then dereferences to read the interface name. Guard against an unbound AP_VLAN sdata before calling get_bss_sdata(), matching the WARN_ON_ONCE(!bss) precondition already used for this same relationship in sta_info.c. Also add check_sdata_in_driver(), used by the neighboring drv_net_fill_forward_path() but missing here. The underlying gap in ieee80211_if_add() - AP_VLAN creation not requiring a bound bss - is not fixed here; other get_bss_sdata() callers may share the exposure. Fixes: 61587f1556fe ("wifi: mac80211: add support for letting drivers register tc offload support") Reported-by: syzbot+f1ba58d6b55abd13239e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f1ba58d6b55abd13239e Signed-off-by: Ayushman Rout --- net/mac80211/driver-ops.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h index f1c0b87fddd5..ecfdb51152f4 100644 --- a/net/mac80211/driver-ops.h +++ b/net/mac80211/driver-ops.h @@ -1702,7 +1702,23 @@ static inline int drv_net_setup_tc(struct ieee80211_local *local, might_sleep(); + /* + * An AP_VLAN interface created without a matching, same-address + * AP interface present never gets sdata->bss populated (see the + * interface-add validation in iface.c, which links bss only + * opportunistically and does not require it). Such an sdata is + * not safe to pass through get_bss_sdata(): container_of() on a + * NULL sdata->bss yields a small invalid pointer, which the + * tracepoint below then dereferences to read the interface name, + * causing a crash. + */ + if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->bss) + return -EIO; + sdata = get_bss_sdata(sdata); + if (!check_sdata_in_driver(sdata)) + return -EIO; + trace_drv_net_setup_tc(local, sdata, type); if (local->ops->net_setup_tc) ret = local->ops->net_setup_tc(&local->hw, &sdata->vif, dev, -- 2.54.0