cfg80211: limit wiphy names to 128 bytes (a7cfebcb) · Commits · 戴 / test

There's currently no limit on wiphy names, other than netlink message size and memory limitations, but that causes issues when, for example, the wiphy name is used in a uevent, e.g. in rfkill where we use the same name for the rfkill instance, and then the buffer there is "only" 2k for the environment variables. This was reported by syzkaller, which used a 4k name. Limit the name to something reasonable, I randomly picked 128. Reported-by:

<syzbot+230d9e642a85d3fec29c@syzkaller.appspotmail.com> Signed-off-by:

Johannes Berg <johannes.berg@intel.com>

include/uapi/linux/nl80211.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -2698,6 +2698,8 @@ enum nl80211_attrs {
		#define NL80211_ATTR_KEYS NL80211_ATTR_KEYS
		#define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS

		#define NL80211_WIPHY_NAME_MAXLEN 128

		#define NL80211_MAX_SUPP_RATES 32
		#define NL80211_MAX_SUPP_HT_RATES 77
		#define NL80211_MAX_SUPP_REG_RULES 64

net/wireless/core.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -95,6 +95,9 @@ static int cfg80211_dev_check_name(struct cfg80211_registered_device *rdev,

		ASSERT_RTNL();

		if (strlen(newname) > NL80211_WIPHY_NAME_MAXLEN)
		return -EINVAL;

		/* prohibit calling the thing phy%d when %d is not its number */
		sscanf(newname, PHY_NAME "%d%n", &wiphy_idx, &taken);
		if (taken == strlen(newname) && wiphy_idx != rdev->wiphy_idx) {

Admin message