Commit 6df4d17c authored by David S. Miller's avatar David S. Miller

Merge tag 'mac80211-for-davem-2017-10-09' of...

Merge tag 'mac80211-for-davem-2017-10-09' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211

Johannes Berg says:

====================
pull-request: mac80211 2017-10-09

The QCA folks found another netlink problem - we were missing validation
of some attributes. It's not super problematic since one can only read a
few bytes beyond the message (and that memory must exist), but here's the
fix for it.

I thought perhaps we can make nla_parse_nested() require a policy, but
given the two-stage validation/parsing in regular netlink that won't work.

Please pull and let me know if there's any problem.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 93b03193 ad670233
...@@ -549,6 +549,14 @@ nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { ...@@ -549,6 +549,14 @@ nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
[NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
}; };
/* policy for packet pattern attributes */
static const struct nla_policy
nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
[NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
[NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
[NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
};
static int nl80211_prepare_wdev_dump(struct sk_buff *skb, static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
struct netlink_callback *cb, struct netlink_callback *cb,
struct cfg80211_registered_device **rdev, struct cfg80211_registered_device **rdev,
...@@ -10532,7 +10540,8 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) ...@@ -10532,7 +10540,8 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
u8 *mask_pat; u8 *mask_pat;
nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
NULL, info->extack); nl80211_packet_pattern_policy,
info->extack);
err = -EINVAL; err = -EINVAL;
if (!pat_tb[NL80211_PKTPAT_MASK] || if (!pat_tb[NL80211_PKTPAT_MASK] ||
!pat_tb[NL80211_PKTPAT_PATTERN]) !pat_tb[NL80211_PKTPAT_PATTERN])
...@@ -10781,7 +10790,8 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, ...@@ -10781,7 +10790,8 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
rem) { rem) {
u8 *mask_pat; u8 *mask_pat;
nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, NULL, NULL); nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
nl80211_packet_pattern_policy, NULL);
if (!pat_tb[NL80211_PKTPAT_MASK] || if (!pat_tb[NL80211_PKTPAT_MASK] ||
!pat_tb[NL80211_PKTPAT_PATTERN]) !pat_tb[NL80211_PKTPAT_PATTERN])
return -EINVAL; return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment