Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6df4d17c authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'mac80211-for-davem-2017-10-09' of... 

Merge tag 'mac80211-for-davem-2017-10-09' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211



Johannes Berg says:

====================
pull-request: mac80211 2017-10-09

The QCA folks found another netlink problem - we were missing validation
of some attributes. It's not super problematic since one can only read a
few bytes beyond the message (and that memory must exist), but here's the
fix for it.

I thought perhaps we can make nla_parse_nested() require a policy, but
given the two-stage validation/parsing in regular netlink that won't work.

Please pull and let me know if there's any problem.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 93b03193 ad670233

net/wireless/nl80211.c

+12 −2
Original line number Diff line number Diff line
@@ -549,6 +549,14 @@ nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { 
	[NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },

};



/* policy for packet pattern attributes */

static const struct nla_policy

nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {

	[NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },

	[NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },

	[NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },

};



static int nl80211_prepare_wdev_dump(struct sk_buff *skb,

				     struct netlink_callback *cb,

				     struct cfg80211_registered_device **rdev,
@@ -10532,7 +10540,8 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) 
			u8 *mask_pat;



			nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,

					 NULL, info->extack);

					 nl80211_packet_pattern_policy,

					 info->extack);

			err = -EINVAL;

			if (!pat_tb[NL80211_PKTPAT_MASK] ||

			    !pat_tb[NL80211_PKTPAT_PATTERN])
@@ -10781,7 +10790,8 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, 
			    rem) {

		u8 *mask_pat;



		nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, NULL, NULL);

		nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,

				 nl80211_packet_pattern_policy, NULL);

		if (!pat_tb[NL80211_PKTPAT_MASK] ||

		    !pat_tb[NL80211_PKTPAT_PATTERN])

			return -EINVAL;