diff options
| author | Hao Chen <flank3rsky@gmail.com> | 2018-01-03 06:00:31 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-03-03 12:24:34 +0300 |
| commit | c38bd3a9fe11720425771392edc0370cd0db0049 (patch) | |
| tree | bde477606b2d796681dfb0f07b8010bd67de3216 /net | |
| parent | d66a35c2a1fa519467e9406be41451e997bbd2d1 (diff) | |
| download | linux-c38bd3a9fe11720425771392edc0370cd0db0049.tar.xz | |
nl80211: Check for the required netlink attribute presence
[ Upstream commit 3ea15452ee85754f70f3b9fa1f23165ef2e77ba7 ]
nl80211_nan_add_func() does not check if the required attribute
NL80211_NAN_FUNC_FOLLOW_UP_DEST is present when processing
NL80211_CMD_ADD_NAN_FUNCTION request. This request can be issued
by users with CAP_NET_ADMIN privilege and may result in NULL dereference
and a system crash. Add a check for the required attribute presence.
Signed-off-by: Hao Chen <flank3rsky@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/wireless/nl80211.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 81bef0676e1d..ea28aa505302 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -11301,7 +11301,8 @@ static int nl80211_nan_add_func(struct sk_buff *skb, break; case NL80211_NAN_FUNC_FOLLOW_UP: if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || - !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) { + !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] || + !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) { err = -EINVAL; goto out; } |