diff options
| author |   Johannes Berg <johannes.berg@intel.com> | 2019-01-15 14:24:23 +0100 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2019-01-19 09:10:30 +0100 |
| commit | 9c5d3afac436beef91b7a6312068e9360c7d8446 (patch) | |
| tree | b6ab5300c24d59f0a51d3bec421728768c0c8ab3 /drivers/net | |
| parent | Merge tag 'mlx5-fixes-2019-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux (diff) | |
| download | linux-dev-9c5d3afac436beef91b7a6312068e9360c7d8446.tar.xz linux-dev-9c5d3afac436beef91b7a6312068e9360c7d8446.zip | |
mac80211_hwsim: check that n_limits makes sense
Under certain circumstances, radios created via netlink could
have n_limits be zero and no possible interface types, which
makes no sense. Reject this early to prevent a WARN_ON() in
cfg80211.
Fixes: 99e3a44bac37 ("mac80211_hwsim: allow setting iftype support")
Reported-by: syzbot+73fd8b0aa60c67fa4b60@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/wireless/mac80211_hwsim.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c index 3a4b8786f7ea..320edcac4699 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c @@ -2761,6 +2761,11 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, BIT(NL80211_CHAN_WIDTH_160); } + if (!n_limits) { + err = -EINVAL; + goto failed_hw; + } + data->if_combination.n_limits = n_limits; data->if_combination.max_interfaces = 2048; data->if_combination.limits = data->if_limits; |