From f77199a0cf6660d45d72010e76c3ab4788e9da5f Mon Sep 17 00:00:00 2001 From: Ping-Ke Shih Date: Wed, 6 May 2026 21:10:00 +0800 Subject: [PATCH] wifi: rtw89: check skb headroom before adding radiotap The radiotap headroom is allocated only if IEEE80211_CONF_MONITOR is set. However, it is potentially racing that SKB allocation without radiotap headroom but adding radiotap from matched PPDU status of another SKB. Add a check to avoid the case. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260506131000.1706298-15-pkshih@realtek.com --- drivers/net/wireless/realtek/rtw89/core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index c21737981b61..432d46dfd26a 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -3758,6 +3758,13 @@ static void rtw89_core_update_radiotap(struct rtw89_dev *rtwdev, if (!(rtwdev->hw->conf.flags & IEEE80211_CONF_MONITOR)) return; + /* + * At transient adding a monitor vif from a station vif, the headroom + * might not include radiotap. + */ + if (unlikely(skb_headroom(skb) < RTW89_RADIOTAP_ROOM + NET_SKB_PAD)) + return; + if (rx_status->encoding == RX_ENC_VHT) rtw89_core_update_radiotap_vht(rtwdev, skb, rx_status, phy_ppdu); else if (rx_status->encoding == RX_ENC_HE)