Received: by 10.223.185.116 with SMTP id b49csp1028442wrg; Fri, 23 Feb 2018 10:36:17 -0800 (PST) X-Google-Smtp-Source: AH8x224pZiGWXKMZuO2tSKLW+Rx/hWh/jzAlLWJH8atM/S6UX8q1IdFomkZR86NQPAWV0SRF/I4y X-Received: by 2002:a17:902:14cb:: with SMTP id y11-v6mr2573804plg.294.1519410977360; Fri, 23 Feb 2018 10:36:17 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519410977; cv=none; d=google.com; s=arc-20160816; b=RTvoccMSlB1HpyzeX0uyHS8vrU1Xh7rPlAAzgaYU5ST13eSfQ1aX6jyJ/TEIEcMhll rHYKULp5QaMQaV/IxE1jcwNHlZMHZ5TVFwe7C4wu+KaSVWx1aYWVNpl+BxNcb3mCqD6D 7uzUv9qhpEe9Qoh3SLNa3baVft4d9+HdEEuxIITHnmofDItqypgnKhsdy2iCmuDa8Z/a KswheScnzLGmjutXZpJvpL+D+ziD+MTIoNYijg7U22QAL2xnya531hAvqBr7cymvvrJI f+OsguwYKi2br578l5UoBCTCPp4ikp+nqrM8xm8UQ7sS2sSz+2oPXorOjJN+BcJpYrsb 9h3A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=b+zlMjbF25QPxpui7HYHO2nT4Z8xSrtR+e43sCRCn7c=; b=HnkMnLetllI7wi52xEpCZjJYJVqU2aNprnMDrXKJGvxJo4BBKXjtnZlkw3eOschArA DqjMvgd8/+WQLx07TORwadphyf4kEIcg6JFknDYTh5IOJyfkjM2LdPJ+5qjUl9IqQ+za Z0wXSa3vL8epDEgnqXjjr6enR6PHEZmKundxI+G0GBpHEoQPfmFM1M6cG0pGNGM1gent Eig4YfnCtXcFlMYpbC1iLSrBXDfV/vQ9WhUfaG6gG+YBTsz1VBIo0dQHjC0w7M8Zmvi7 fM+peyTLs5a4mbEVD+bIPomi5BKuzj1iQZ5kCbtzoCg1Gtyz9PwJkNOHIM6Psb0FiDDm 77Sw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d20-v6si2202144pls.557.2018.02.23.10.35.59; Fri, 23 Feb 2018 10:36:17 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753412AbeBWSd7 (ORCPT + 99 others); Fri, 23 Feb 2018 13:33:59 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:36714 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753358AbeBWSd4 (ORCPT ); Fri, 23 Feb 2018 13:33:56 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 0286A122F; Fri, 23 Feb 2018 18:33:55 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+1ddfb3357e1d7bb5b5d3@syzkaller.appspotmail.com, Johannes Berg Subject: [PATCH 4.4 003/193] cfg80211: check dev_set_name() return value Date: Fri, 23 Feb 2018 19:23:56 +0100 Message-Id: <20180223170326.555798015@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170325.997716448@linuxfoundation.org> References: <20180223170325.997716448@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johannes Berg commit 59b179b48ce2a6076448a44531242ac2b3f6cef2 upstream. syzbot reported a warning from rfkill_alloc(), and after a while I think that the reason is that it was doing fault injection and the dev_set_name() failed, leaving the name NULL, and we didn't check the return value and got to rfkill_alloc() with a NULL name. Since we really don't want a NULL name, we ought to check the return value. Fixes: fb28ad35906a ("net: struct device - replace bus_id with dev_name(), dev_set_name()") Reported-by: syzbot+1ddfb3357e1d7bb5b5d3@syzkaller.appspotmail.com Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/wireless/core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -390,6 +390,8 @@ struct wiphy *wiphy_new_nm(const struct if (rv) goto use_default_name; } else { + int rv; + use_default_name: /* NOTE: This is *probably* safe w/out holding rtnl because of * the restrictions on phy names. Probably this call could @@ -397,7 +399,11 @@ use_default_name: * phyX. But, might should add some locking and check return * value, and use a different name if this one exists? */ - dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx); + rv = dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx); + if (rv < 0) { + kfree(rdev); + return NULL; + } } INIT_LIST_HEAD(&rdev->wdev_list);