Linux wireless drivers development
 help / color / mirror / Atom feed
* [PATCH 1/5] nl80211: always check nla_nest_start() return value
@ 2016-09-14  8:11 Johannes Berg
  2016-09-14  8:11 ` [PATCH 2/5] nl80211: always check nla_put* return values Johannes Berg
                   ` (3 more replies)
  0 siblings, 4 replies; 5+ messages in thread
From: Johannes Berg @ 2016-09-14  8:11 UTC (permalink / raw)
  To: linux-wireless; +Cc: Johannes Berg

From: Johannes Berg <johannes.berg@intel.com>

If the message got full during nla_nest_start(), it can return
NULL. None of the cases here seem like that can really happen,
but check the return value nonetheless.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/wireless/nl80211.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index dc81c5b91f61..4c8cc743ae7d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -8013,6 +8013,8 @@ __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
 	}
 
 	data = nla_nest_start(skb, attr);
+	if (!data)
+		goto nla_put_failure;
 
 	((void **)skb->cb)[0] = rdev;
 	((void **)skb->cb)[1] = hdr;
@@ -9449,8 +9451,14 @@ static int nl80211_send_wowlan_nd(struct sk_buff *msg,
 
 	if (req->n_match_sets) {
 		matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
+		if (!matches)
+			return -ENOBUFS;
+
 		for (i = 0; i < req->n_match_sets; i++) {
 			match = nla_nest_start(msg, i);
+			if (!match)
+				return -ENOBUFS;
+
 			nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
 				req->match_sets[i].ssid.ssid_len,
 				req->match_sets[i].ssid.ssid);
@@ -9465,6 +9473,9 @@ static int nl80211_send_wowlan_nd(struct sk_buff *msg,
 
 	for (i = 0; i < req->n_scan_plans; i++) {
 		scan_plan = nla_nest_start(msg, i + 1);
+		if (!scan_plan)
+			return -ENOBUFS;
+
 		if (!scan_plan ||
 		    nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
 				req->scan_plans[i].interval) ||
-- 
2.8.1

^ permalink raw reply related	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2016-09-14  8:12 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-09-14  8:11 [PATCH 1/5] nl80211: always check nla_nest_start() return value Johannes Berg
2016-09-14  8:11 ` [PATCH 2/5] nl80211: always check nla_put* return values Johannes Berg
2016-09-14  8:11 ` [PATCH 3/5] mac80211: remove unused assignment Johannes Berg
2016-09-14  8:11 ` [PATCH 4/5] mac80211: remove pointless chanctx NULL check Johannes Berg
2016-09-14  8:11 ` [PATCH 5/5] mac80211: remove sta_remove_debugfs driver callback Johannes Berg

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox