Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 59b179b4 authored by Johannes Berg's avatar Johannes Berg
Browse files

cfg80211: check dev_set_name() return value 



syzbot reported a warning from rfkill_alloc(), and after a while
I think that the reason is that it was doing fault injection and
the dev_set_name() failed, leaving the name NULL, and we didn't
check the return value and got to rfkill_alloc() with a NULL name.
Since we really don't want a NULL name, we ought to check the
return value.

Fixes: fb28ad35 ("net: struct device - replace bus_id with dev_name(), dev_set_name()")
Reported-by: default avatar <syzbot+1ddfb3357e1d7bb5b5d3@syzkaller.appspotmail.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 51a1aaa6

net/wireless/core.c

+7 −1
Original line number Diff line number Diff line
@@ -439,6 +439,8 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv, 
		if (rv)

			goto use_default_name;

	} else {

		int rv;



use_default_name:

		/* NOTE:  This is *probably* safe w/out holding rtnl because of

		 * the restrictions on phy names.  Probably this call could
@@ -446,7 +448,11 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv, 
		 * phyX.  But, might should add some locking and check return

		 * value, and use a different name if this one exists?

		 */

		dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);

		rv = dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);

		if (rv < 0) {

			kfree(rdev);

			return NULL;

		}

	}



	INIT_LIST_HEAD(&rdev->wiphy.wdev_list);