linux-kernel - Re: [PATCH AUTOSEL 4.19] wifi: cfg80211: wext: add extra SIOCSIWSCAN data check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Zo5cn37w8NjVyZdj@duo.ucw.cz>
Date: Wed, 10 Jul 2024 12:04:15 +0200
From: Pavel Machek <pavel@...x.de>
To: Sasha Levin <sashal@...nel.org>
Cc: linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	Dmitry Antipov <dmantipov@...dex.ru>,
	syzbot+253cd2d2491df77c93ac@...kaller.appspotmail.com,
	Johannes Berg <johannes.berg@...el.com>, johannes@...solutions.net,
	davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
	pabeni@...hat.com, linux-wireless@...r.kernel.org,
	netdev@...r.kernel.org
Subject: Re: [PATCH AUTOSEL 4.19] wifi: cfg80211: wext: add extra SIOCSIWSCAN
 data check

Hi!

> [ Upstream commit 6ef09cdc5ba0f93826c09d810c141a8d103a80fc ]
> 
> In 'cfg80211_wext_siwscan()', add extra check whether number of
> channels passed via 'ioctl(sock, SIOCSIWSCAN, ...)' doesn't exceed
> IW_MAX_FREQUENCIES and reject invalid request with -EINVAL otherwise.

This results in very confusing code in 4.19 at least. It should goto
out for consistency, exploting kfree(NULL) to be nop. Ok, not sure we
care...

Best regards,
								Pavel
								
> diff --git a/net/wireless/scan.c b/net/wireless/scan.c
> index dacb9ceee3efd..0dc27703443c8 100644
> --- a/net/wireless/scan.c
> +++ b/net/wireless/scan.c
> @@ -1405,10 +1405,14 @@ int cfg80211_wext_siwscan(struct net_device *dev,
>  	wiphy = &rdev->wiphy;
>  
>  	/* Determine number of channels, needed to allocate creq */
> -	if (wreq && wreq->num_channels)
> +	if (wreq && wreq->num_channels) {
> +		/* Passed from userspace so should be checked */
> +		if (unlikely(wreq->num_channels > IW_MAX_FREQUENCIES))
> +			return -EINVAL;
>  		n_channels = wreq->num_channels;
> -	else
> +	} else {
>  		n_channels = ieee80211_get_num_supported_channels(wiphy);
> +	}
>  
>  	creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
>  		       n_channels * sizeof(void *),

-- 
DENX Software Engineering GmbH,        Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)