diff options
| author |   Hao Chen <flank3rsky@gmail.com> | 2018-01-03 11:00:31 +0800 |
|---|---|---|
| committer |   Johannes Berg <johannes.berg@intel.com> | 2018-01-04 15:22:02 +0100 |
| commit | 3ea15452ee85754f70f3b9fa1f23165ef2e77ba7 (patch) | |
| tree | 6b845a2ef0a25201fc05cfc0fe6a6a72f664bfc0 /net/wireless | |
| parent | Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue (diff) | |
| download | linux-dev-3ea15452ee85754f70f3b9fa1f23165ef2e77ba7.tar.xz linux-dev-3ea15452ee85754f70f3b9fa1f23165ef2e77ba7.zip | |
nl80211: Check for the required netlink attribute presence
nl80211_nan_add_func() does not check if the required attribute
NL80211_NAN_FUNC_FOLLOW_UP_DEST is present when processing
NL80211_CMD_ADD_NAN_FUNCTION request. This request can be issued
by users with CAP_NET_ADMIN privilege and may result in NULL dereference
and a system crash. Add a check for the required attribute presence.
Signed-off-by: Hao Chen <flank3rsky@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/nl80211.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 213d0c498c97..2b3dbcd40e46 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -11361,7 +11361,8 @@ static int nl80211_nan_add_func(struct sk_buff *skb, break; case NL80211_NAN_FUNC_FOLLOW_UP: if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || - !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) { + !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] || + !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) { err = -EINVAL; goto out; } |