From: Moon Hee Lee <moonhee.lee.ca@gmail.com> stable inclusion from stable-v6.1.148 commit 0c84204cf0bbe89e454a5caccc6a908bc7db1542 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC9N CVE: CVE-2025-38644 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit 16ecdab5446f15a61ec88eb0d23d25d009821db0 ] syzbot triggered a WARN in ieee80211_tdls_oper() by sending NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT, before association completed and without prior TDLS setup. This left internal state like sdata->u.mgd.tdls_peer uninitialized, leading to a WARN_ON() in code paths that assumed it was valid. Reject the operation early if not in station mode or not associated. Reported-by: syzbot+f73f203f8c9b19037380@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f73f203f8c9b19037380 Fixes: 81dd2b882241 ("mac80211: move TDLS data to mgd private part") Tested-by: syzbot+f73f203f8c9b19037380@syzkaller.appspotmail.com Signed-off-by: Moon Hee Lee <moonhee.lee.ca@gmail.com> Link: https://patch.msgid.link/20250715230904.661092-2-moonhee.lee.ca@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Conflicts: net/mac80211/tdls.c [ Context conflicts due to f276e20b182d ("wifi: mac80211: move interface config to new struct") not merged, which is depended on by 0c84204cf0bb ] Signed-off-by: Jiacheng Yu <yujiacheng3@huawei.com> --- net/mac80211/tdls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c index 67745d1d4c5d..5d18644aa7a9 100644 --- a/net/mac80211/tdls.c +++ b/net/mac80211/tdls.c @@ -1350,7 +1350,7 @@ int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev, if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)) return -ENOTSUPP; - if (sdata->vif.type != NL80211_IFTYPE_STATION) + if (sdata->vif.type != NL80211_IFTYPE_STATION || !sdata->vif.bss_conf.assoc) return -EINVAL; switch (oper) { -- 2.34.1