All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/1] nl80211: Prevent out-of-bounds read when processing NL80211_ATTR_REG_ALPHA2
@ 2022-04-01 10:50 Lee Jones
  2022-04-01 18:35 ` Jeff Johnson
  2022-04-05  9:14   ` kernel test robot
  0 siblings, 2 replies; 10+ messages in thread
From: Lee Jones @ 2022-04-01 10:50 UTC (permalink / raw)
  To: lee.jones
  Cc: linux-kernel, stable, Johannes Berg, David S. Miller,
	Jakub Kicinski, Paolo Abeni, linux-wireless, netdev

Checks are presently in place in validate_nla() to ensure strings
greater than 2 are not passed in by the user which could potentially
cause issues.

However, there is nothing to prevent userspace from only providing a
single (1) Byte as the data length parameter via nla_put().  If this
were to happen, it would cause an OOB read in regulatory_hint_user(),
since it makes assumptions that alpha2[0] and alpha2[1] will always be
accessible.

Add an additional check, to ensure enough data has been allocated to
hold both Bytes.

Cc: <stable@vger.kernel.org>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Lee Jones <lee.jones@linaro.org>
---
 net/wireless/nl80211.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index ee1c2b6b69711..80a516033db36 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -7536,6 +7536,10 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
 		if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
 			return -EINVAL;
 
+		if (nla_len(info->attrs[NL80211_ATTR_REG_ALPHA2]) !=
+		    nl80211_policy[NL80211_ATTR_REG_ALPHA2].len)
+			return -EINVAL;
+
 		data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
 		return regulatory_hint_user(data, user_reg_hint_type);
 	case NL80211_USER_REG_HINT_INDOOR:
-- 
2.35.1.1094.g7c7d902a7c-goog


^ permalink raw reply related	[flat|nested] 10+ messages in thread
end of thread, other threads:[~2022-04-12 11:42 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-04-01 10:50 [PATCH 1/1] nl80211: Prevent out-of-bounds read when processing NL80211_ATTR_REG_ALPHA2 Lee Jones
2022-04-01 18:35 ` Jeff Johnson
2022-04-05  9:14 ` [nl80211] 584f2e43bb: hwsim.ap_country.fail kernel test robot
2022-04-05  9:14   ` kernel test robot
2022-04-11  9:25   ` Lee Jones
2022-04-11  9:25     ` Lee Jones
2022-04-11  9:27     ` Johannes Berg
2022-04-11  9:27       ` Johannes Berg
2022-04-12 10:23       ` Lee Jones
2022-04-12 10:23         ` Lee Jones

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.