Received: by 10.223.185.116 with SMTP id b49csp1082023wrg; Fri, 23 Feb 2018 11:35:38 -0800 (PST) X-Google-Smtp-Source: AH8x226EP56PWsgVvfhdJfuwuGuECz1TNm9bvcP/ZDAXyIqys9GByOYdPU161IsK5dz4dDgmu9PF X-Received: by 2002:a17:902:34a:: with SMTP id 68-v6mr2739919pld.276.1519414538689; Fri, 23 Feb 2018 11:35:38 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519414538; cv=none; d=google.com; s=arc-20160816; b=rlflRPvhlnuRlWmEVVmfsJAwTEhPQGHfxkEJuPReDr0tHPtAEdrpNhkI1p5uF+eREP cvMpwDIg8adMbTfmxgfejWC1r3ukk7ODED5HG7EUSVlxVwn9Wlc7D450oPAiONVHNehs u//9gF4nVdvZOOnsZh1SDEuqE+HjDOsxMhSAH18V5nAz7HzpAf/heZu5sPXaxTSSGkZA uaP0qqC6nFvY5wWDBxvEDlRxhRRkZEbX3ZvWO+su6dHM9NUq2simRUjf0nc2Qi4xA/ha 8byVKaZ1HEV2PuNqkSzveL/eH08k/wLgX1TWKspxxf7l9XoYfH3/CxQBeIMW65DUiqTf ioQQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=0yvk67MmB12wkUc9cyIk689FLtXK32vWvid1TgFXNOI=; b=BU9RaofsVKe5U9hyo8vL2kHN2URDMz6U/azdDixHzVK5+e5jLs6wL+iXbFg93KG5zb Xu7MBwDNmBfZ3Dk3I+P8Up9t+cMHqq4qDjiPVCKZeHAvkdYwN2lMPdSCVh4Am1vFJIdu ljZvdTdoK/ukFQxZxqi9s3VEf+V5YPpfTa7ngyesMYDXuRwT8QT4XJDGGaylHz5OQIv7 DdvPmMkBqjuPvi5DP4rIJrgOCHj4+HHQlvxxjqmZGcb6w65IR9iJgTIRijXj+yuPrLpa C35HptLZfSjDULVVgTz2xvSi2XDnpaDCizXns6wjeps7W5SLZeHlhIqyA7dSzTw6KRUt k8Ow== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id i11si1862217pgq.332.2018.02.23.11.35.24; Fri, 23 Feb 2018 11:35:38 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934839AbeBWSut (ORCPT + 99 others); Fri, 23 Feb 2018 13:50:49 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:45760 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934306AbeBWSup (ORCPT ); Fri, 23 Feb 2018 13:50:45 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 43ABF12E8; Fri, 23 Feb 2018 18:50:44 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+8dd9051ff19940290931@syzkaller.appspotmail.com, Johannes Berg Subject: [PATCH 4.14 007/159] mac80211_hwsim: validate number of different channels Date: Fri, 23 Feb 2018 19:25:15 +0100 Message-Id: <20180223170744.022391260@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170743.086611315@linuxfoundation.org> References: <20180223170743.086611315@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johannes Berg commit 51a1aaa631c90223888d8beac4d649dc11d2ca55 upstream. When creating a new radio on the fly, hwsim allows this to be done with an arbitrary number of channels, but cfg80211 only supports a limited number of simultaneous channels, leading to a warning. Fix this by validating the number - this requires moving the define for the maximum out to a visible header file. Reported-by: syzbot+8dd9051ff19940290931@syzkaller.appspotmail.com Fixes: b59ec8dd4394 ("mac80211_hwsim: fix number of channels in interface combinations") Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/mac80211_hwsim.c | 5 +++++ include/net/cfg80211.h | 2 ++ net/wireless/core.h | 2 -- 3 files changed, 7 insertions(+), 2 deletions(-) --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c @@ -3119,6 +3119,11 @@ static int hwsim_new_radio_nl(struct sk_ if (info->attrs[HWSIM_ATTR_CHANNELS]) param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]); + if (param.channels > CFG80211_MAX_NUM_DIFFERENT_CHANNELS) { + GENL_SET_ERR_MSG(info, "too many channels specified"); + return -EINVAL; + } + if (info->attrs[HWSIM_ATTR_NO_VIF]) param.no_vif = true; --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -815,6 +815,8 @@ struct cfg80211_csa_settings { u8 count; }; +#define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10 + /** * struct iface_combination_params - input parameters for interface combinations * --- a/net/wireless/core.h +++ b/net/wireless/core.h @@ -502,8 +502,6 @@ void cfg80211_stop_p2p_device(struct cfg void cfg80211_stop_nan(struct cfg80211_registered_device *rdev, struct wireless_dev *wdev); -#define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10 - #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS #define CFG80211_DEV_WARN_ON(cond) WARN_ON(cond) #else