summaryrefslogtreecommitdiff
path: root/net/wireless
diff options
context:
space:
mode:
authorLuis R. Rodriguez <mcgrof@do-not-panic.com>2013-11-05 21:18:01 +0400
committerJohannes Berg <johannes.berg@intel.com>2013-11-25 23:51:02 +0400
commite438768ff9b22c83a968e14b79e8c83128e8bfe4 (patch)
tree956366ad035f64af8965c3a737eaa74598d1e1b6 /net/wireless
parentcc493e4f5296f4da111f25ea4a216bb77270ccc6 (diff)
downloadlinux-e438768ff9b22c83a968e14b79e8c83128e8bfe4.tar.xz
cfg80211: check regulatory request alpha2 early
Currently nl80211 allows userspace to send the kernel a bogus regulatory domain with at most 32 rules set and it won't reject it until after its allocated memory. Let's be smart about it and take advantage that the last_request is now available under RTNL and check if the alpha2 matches an expected request and reject any bogus userspace requests prior to hitting the memory allocator. Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
-rw-r--r--net/wireless/nl80211.c3
-rw-r--r--net/wireless/reg.c2
-rw-r--r--net/wireless/reg.h1
3 files changed, 5 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 04fa8bb1b4bb..7b73132910b7 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5100,6 +5100,9 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
return -EINVAL;
}
+ if (!reg_is_valid_request(alpha2))
+ return -EINVAL;
+
size_of_regd = sizeof(struct ieee80211_regdomain) +
num_rules * sizeof(struct ieee80211_reg_rule);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index b4b16871a56e..d8f047aadd49 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -450,7 +450,7 @@ static int call_crda(const char *alpha2)
return kobject_uevent(&reg_pdev->dev.kobj, KOBJ_CHANGE);
}
-static bool reg_is_valid_request(const char *alpha2)
+bool reg_is_valid_request(const char *alpha2)
{
struct regulatory_request *lr = get_last_request();
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index 9677e3c13da9..b4076babaf47 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -18,6 +18,7 @@
extern const struct ieee80211_regdomain __rcu *cfg80211_regdomain;
+bool reg_is_valid_request(const char *alpha2);
bool is_world_regdom(const char *alpha2);
bool reg_supported_dfs_region(u8 dfs_region);