Received: by 10.223.185.116 with SMTP id b49csp1083964wrg; Fri, 23 Feb 2018 11:38:04 -0800 (PST) X-Google-Smtp-Source: AH8x224MphHi0f0gCnuO6pHPpXTJip2Ka9+dqGPxIQzhlI2x3okEfsqU0yCw+ujsoyBYtvPFx/x2 X-Received: by 2002:a17:902:7f0b:: with SMTP id d11-v6mr2765732plm.350.1519414684054; Fri, 23 Feb 2018 11:38:04 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519414684; cv=none; d=google.com; s=arc-20160816; b=hOr/EPZFpG0rTqxf9MyS80aOI/PPm8YDiLnm+LYvfCu2NZHfXSijo935hxpe55lxx/ cCpVh+MK68X/n8iHB6Dwd3Ve2Vvy5KXZSFf1oD5Ef/j94M3+UWsQXJ+dF+pzTNaorTqH gwCETZR7IfT5dNU60YQj+84FXcNz/955yUOufkxF3vZCJ7nlzfnyooT6S1TbpE0V9sRr yPb/Mrk6H8xK3uf4sssJG56mLJZmRyX2/MroJnT8cIS0jNJnC77O2KQ81s4h/Zdhi+Op 6ISy6zQJ02dbrmv7rXVSd6wvM+SPermQS/yzv6Wok4uAAAzYemxhpRdTtAxbZ/1xlK7k ptvw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=t0WPeKXdslwf1C/HGQB5yT5pSOS0VffIJSCT5pA0JbA=; b=e/rOBhC/fR2AXnaDIB2U0UmiWwHM8jhGDZRWvi8wTOgZ/PVROxq4dsPlUt7oukTxbM LIJXh0TeYnmtHMj76Ds2RARzrDqXEYMkgAi8DcqnKgSFNZ3b1zGUxlyqrihOosDT/rvN Hyizi75p/115WCA0BbppV+L84MRLOhkr+UHgtt5RctmT0gmOeQc0NNDKQYgeP0CE0OqG xQzUpS7qBSezsGVNkfPzpuFRhNeHOEJsoqIDHi6MQlGPJcLSkQ4yZy75TdCqZy+ccc40 IyBgeMGNN2Ou6wTakLBFPetWAkX1HNoSSdcedMaZpcTH0FkdJQ03F/7ZkIU//SWq89Dh Fr2A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id b13si2236467pfi.53.2018.02.23.11.37.34; Fri, 23 Feb 2018 11:38:04 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934809AbeBWSuo (ORCPT + 99 others); Fri, 23 Feb 2018 13:50:44 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:45738 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934747AbeBWSum (ORCPT ); Fri, 23 Feb 2018 13:50:42 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 6E6C712E8; Fri, 23 Feb 2018 18:50:41 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+1ddfb3357e1d7bb5b5d3@syzkaller.appspotmail.com, Johannes Berg Subject: [PATCH 4.14 006/159] cfg80211: check dev_set_name() return value Date: Fri, 23 Feb 2018 19:25:14 +0100 Message-Id: <20180223170743.886605795@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170743.086611315@linuxfoundation.org> References: <20180223170743.086611315@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johannes Berg commit 59b179b48ce2a6076448a44531242ac2b3f6cef2 upstream. syzbot reported a warning from rfkill_alloc(), and after a while I think that the reason is that it was doing fault injection and the dev_set_name() failed, leaving the name NULL, and we didn't check the return value and got to rfkill_alloc() with a NULL name. Since we really don't want a NULL name, we ought to check the return value. Fixes: fb28ad35906a ("net: struct device - replace bus_id with dev_name(), dev_set_name()") Reported-by: syzbot+1ddfb3357e1d7bb5b5d3@syzkaller.appspotmail.com Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/wireless/core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -439,6 +439,8 @@ struct wiphy *wiphy_new_nm(const struct if (rv) goto use_default_name; } else { + int rv; + use_default_name: /* NOTE: This is *probably* safe w/out holding rtnl because of * the restrictions on phy names. Probably this call could @@ -446,7 +448,11 @@ use_default_name: * phyX. But, might should add some locking and check return * value, and use a different name if this one exists? */ - dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx); + rv = dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx); + if (rv < 0) { + kfree(rdev); + return NULL; + } } INIT_LIST_HEAD(&rdev->wiphy.wdev_list);