GitHub-Mirror/linux-bl808
2
0
Fork 0
mirror of https://github.com/Fishwaldo/linux-bl808.git synced 2025-06-07 07:05:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

cfg80211: check regulatory request alpha2 early

Browse source 
Currently nl80211 allows userspace to send the kernel
a bogus regulatory domain with at most 32 rules set
and it won't reject it until after its allocated
memory. Let's be smart about it and take advantage
that the last_request is now available under RTNL
and check if the alpha2 matches an expected request
and reject any bogus userspace requests prior to
hitting the memory allocator.

Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Luis R. Rodriguez 2013-11-05 09:18:01 -08:00 • committed by Johannes Berg
parent cc493e4f52
commit e438768ff9
3 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
net/wireless/nl80211.c
View file

@ -5100,6 +5100,9 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
return -EINVAL; return -EINVAL;
} }
if (!reg_is_valid_request(alpha2))
return -EINVAL;
size_of_regd = sizeof(struct ieee80211_regdomain) + size_of_regd = sizeof(struct ieee80211_regdomain) +
num_rules * sizeof(struct ieee80211_reg_rule); num_rules * sizeof(struct ieee80211_reg_rule);

2
net/wireless/reg.c
View file

@ -450,7 +450,7 @@ static int call_crda(const char *alpha2)
return kobject_uevent(&reg_pdev->dev.kobj, KOBJ_CHANGE); return kobject_uevent(&reg_pdev->dev.kobj, KOBJ_CHANGE);
} }
static bool reg_is_valid_request(const char *alpha2) bool reg_is_valid_request(const char *alpha2)
{ {
struct regulatory_request *lr = get_last_request(); struct regulatory_request *lr = get_last_request();

1
net/wireless/reg.h
View file

@ -18,6 +18,7 @@
extern const struct ieee80211_regdomain __rcu *cfg80211_regdomain; extern const struct ieee80211_regdomain __rcu *cfg80211_regdomain;
bool reg_is_valid_request(const char *alpha2);
bool is_world_regdom(const char *alpha2); bool is_world_regdom(const char *alpha2);
bool reg_supported_dfs_region(u8 dfs_region); bool reg_supported_dfs_region(u8 dfs_region);