A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 19:21:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

cfg80211: limit wiphy names to 128 bytes

Browse source 
There's currently no limit on wiphy names, other than netlink
message size and memory limitations, but that causes issues when,
for example, the wiphy name is used in a uevent, e.g. in rfkill
where we use the same name for the rfkill instance, and then the
buffer there is "only" 2k for the environment variables.

This was reported by syzkaller, which used a 4k name.

Limit the name to something reasonable, I randomly picked 128.

Reported-by: [email protected]
Signed-off-by: Johannes Berg <[email protected]>
This commit is contained in:
Johannes Berg 2018-04-03 14:33:49 +02:00
commit a7cfebcb75
2 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
net/wireless/core.c
View file

@ -95,6 +95,9 @@ static int cfg80211_dev_check_name(struct cfg80211_registered_device *rdev,
ASSERT_RTNL();
if (strlen(newname) > NL80211_WIPHY_NAME_MAXLEN)
return -EINVAL;
/* prohibit calling the thing phy%d when %d is not its number */
sscanf(newname, PHY_NAME "%d%n", &wiphy_idx, &taken);
if (taken == strlen(newname) && wiphy_idx != rdev->wiphy_idx) {