Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a77831e1 authored by Johannes Berg's avatar Johannes Berg Committed by Greg Kroah-Hartman
Browse files

cfg80211: limit wiphy names to 128 bytes 



commit a7cfebcb7594a24609268f91299ab85ba064bf82 upstream.

There's currently no limit on wiphy names, other than netlink
message size and memory limitations, but that causes issues when,
for example, the wiphy name is used in a uevent, e.g. in rfkill
where we use the same name for the rfkill instance, and then the
buffer there is "only" 2k for the environment variables.

This was reported by syzkaller, which used a 4k name.

Limit the name to something reasonable, I randomly picked 128.

Reported-by: default avatar <syzbot+230d9e642a85d3fec29c@syzkaller.appspotmail.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 58b7ce6f

include/uapi/linux/nl80211.h

+2 −0
Original line number Diff line number Diff line
@@ -2026,6 +2026,8 @@ enum nl80211_attrs { 
#define NL80211_ATTR_KEYS NL80211_ATTR_KEYS

#define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS



#define NL80211_WIPHY_NAME_MAXLEN		128



#define NL80211_MAX_SUPP_RATES			32

#define NL80211_MAX_SUPP_HT_RATES		77

#define NL80211_MAX_SUPP_REG_RULES		32

net/wireless/core.c

+3 −0
Original line number Diff line number Diff line
@@ -94,6 +94,9 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev, 


	ASSERT_RTNL();



	if (strlen(newname) > NL80211_WIPHY_NAME_MAXLEN)

		return -EINVAL;



	/* prohibit calling the thing phy%d when %d is not its number */

	sscanf(newname, PHY_NAME "%d%n", &wiphy_idx, &taken);

	if (taken == strlen(newname) && wiphy_idx != rdev->wiphy_idx) {