diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2022-04-11 11:42:03 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-04-20 09:34:19 +0200 |
| commit | cab64cb82fe1a2436bb7991cb628d76de3c44751 (patch) | |
| tree | 00e0c2d92b07724cb50d3cce4d002bc5a3887d03 /net | |
| parent | 63038f6e96a77a0abf8083649c53e6a72c1a0124 (diff) | |
| download | linux-stable-cab64cb82fe1a2436bb7991cb628d76de3c44751.tar.gz linux-stable-cab64cb82fe1a2436bb7991cb628d76de3c44751.tar.bz2 linux-stable-cab64cb82fe1a2436bb7991cb628d76de3c44751.zip | |
nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size
commit 6624bb34b4eb19f715db9908cca00122748765d7 upstream.
We need this to be at least two bytes, so we can access
alpha2[0] and alpha2[1]. It may be three in case some
userspace used NUL-termination since it was NLA_STRING
(and we also push it out with NUL-termination).
Cc: stable@vger.kernel.org
Reported-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20220411114201.fd4a31f06541.Ie7ff4be2cf348d8cc28ed0d626fc54becf7ea799@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/wireless/nl80211.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 2f9ead98a9da..fe9cade6b4fb 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -509,7 +509,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { .len = IEEE80211_MAX_MESH_ID_LEN }, [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT, - [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 }, + /* allow 3 for NUL-termination, we used to declare this NLA_STRING */ + [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3), [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, |