On 4/1/2022 3:50 AM, Lee Jones wrote:
Checks are presently in place in validate_nla() to ensure strings greater than 2 are not passed in by the user which could potentially cause issues.
However, there is nothing to prevent userspace from only providing a single (1) Byte as the data length parameter via nla_put(). If this were to happen, it would cause an OOB read in regulatory_hint_user(), since it makes assumptions that alpha2[0] and alpha2[1] will always be accessible.
Add an additional check, to ensure enough data has been allocated to hold both Bytes.
Cc: stable@vger.kernel.org Cc: Johannes Berg johannes@sipsolutions.net Cc: "David S. Miller" davem@davemloft.net Cc: Jakub Kicinski kuba@kernel.org Cc: Paolo Abeni pabeni@redhat.com Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Lee Jones lee.jones@linaro.org
net/wireless/nl80211.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index ee1c2b6b69711..80a516033db36 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -7536,6 +7536,10 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info) if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) return -EINVAL;
if (nla_len(info->attrs[NL80211_ATTR_REG_ALPHA2]) !=nl80211_policy[NL80211_ATTR_REG_ALPHA2].len)return -EINVAL;- data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); return regulatory_hint_user(data, user_reg_hint_type); case NL80211_USER_REG_HINT_INDOOR:
LGTM
doesn't nl80211_set_reg() also have this issue? alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); [...] rd->alpha2[0] = alpha2[0]; rd->alpha2[1] = alpha2[1];