releases/4.4.133/cfg80211-limit-wiphy-names-to-128-bytes.patch

   1 From a7cfebcb7594a24609268f91299ab85ba064bf82 Mon Sep 17 00:00:00 2001
   2 From: Johannes Berg <johannes.berg@intel.com>
   3 Date: Tue, 3 Apr 2018 14:33:49 +0200
   4 Subject: cfg80211: limit wiphy names to 128 bytes
   5
   6 From: Johannes Berg <johannes.berg@intel.com>
   7
   8 commit a7cfebcb7594a24609268f91299ab85ba064bf82 upstream.
   9
  10 There's currently no limit on wiphy names, other than netlink
  11 message size and memory limitations, but that causes issues when,
  12 for example, the wiphy name is used in a uevent, e.g. in rfkill
  13 where we use the same name for the rfkill instance, and then the
  14 buffer there is "only" 2k for the environment variables.
  15
  16 This was reported by syzkaller, which used a 4k name.
  17
  18 Limit the name to something reasonable, I randomly picked 128.
  19
  20 Reported-by: syzbot+230d9e642a85d3fec29c@syzkaller.appspotmail.com
  21 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23
  24 ---
  25  include/uapi/linux/nl80211.h |    2 ++
  26  net/wireless/core.c          |    3 +++
  27  2 files changed, 5 insertions(+)
  28
  29 --- a/include/uapi/linux/nl80211.h
  30 +++ b/include/uapi/linux/nl80211.h
  31 @@ -2195,6 +2195,8 @@ enum nl80211_attrs {
  32  #define NL80211_ATTR_KEYS NL80211_ATTR_KEYS
  33  #define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS
  34
  35 +#define NL80211_WIPHY_NAME_MAXLEN              128
  36 +
  37  #define NL80211_MAX_SUPP_RATES                 32
  38  #define NL80211_MAX_SUPP_HT_RATES              77
  39  #define NL80211_MAX_SUPP_REG_RULES             64
  40 --- a/net/wireless/core.c
  41 +++ b/net/wireless/core.c
  42 @@ -94,6 +94,9 @@ static int cfg80211_dev_check_name(struc
  43
  44         ASSERT_RTNL();
  45
  46 +       if (strlen(newname) > NL80211_WIPHY_NAME_MAXLEN)
  47 +               return -EINVAL;
  48 +
  49         /* prohibit calling the thing phy%d when %d is not its number */
  50         sscanf(newname, PHY_NAME "%d%n", &wiphy_idx, &taken);
  51         if (taken == strlen(newname) && wiphy_idx != rdev->wiphy_idx) {