diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2018-04-03 15:33:49 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-05-25 11:54:57 +0300 |
| commit | a77831e13f9068dc2b3b3f3965323015fb527f4c (patch) | |
| tree | 447485c8837008c54976d1e0047ae8c83cb7c80d /net/wireless | |
| parent | 58b7ce6f9ef2367f86384b20458642945993b816 (diff) | |
| download | linux-a77831e13f9068dc2b3b3f3965323015fb527f4c.tar.xz | |
cfg80211: limit wiphy names to 128 bytes
commit a7cfebcb7594a24609268f91299ab85ba064bf82 upstream.
There's currently no limit on wiphy names, other than netlink
message size and memory limitations, but that causes issues when,
for example, the wiphy name is used in a uevent, e.g. in rfkill
where we use the same name for the rfkill instance, and then the
buffer there is "only" 2k for the environment variables.
This was reported by syzkaller, which used a 4k name.
Limit the name to something reasonable, I randomly picked 128.
Reported-by: syzbot+230d9e642a85d3fec29c@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/core.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/wireless/core.c b/net/wireless/core.c index 6c23065490d3..9caa1a80569f 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -94,6 +94,9 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev, ASSERT_RTNL(); + if (strlen(newname) > NL80211_WIPHY_NAME_MAXLEN) + return -EINVAL; + /* prohibit calling the thing phy%d when %d is not its number */ sscanf(newname, PHY_NAME "%d%n", &wiphy_idx, &taken); if (taken == strlen(newname) && wiphy_idx != rdev->wiphy_idx) { |