| From e007b857e88097c96c45620bf3b04a4e309053d1 Mon Sep 17 00:00:00 2001 |
| From: Eliad Peller <eliad@wizery.com> |
| Date: Thu, 24 Nov 2011 18:13:56 +0200 |
| Subject: nl80211: fix MAC address validation |
| |
| From: Eliad Peller <eliad@wizery.com> |
| |
| commit e007b857e88097c96c45620bf3b04a4e309053d1 upstream. |
| |
| MAC addresses have a fixed length. The current |
| policy allows passing < ETH_ALEN bytes, which |
| might result in reading beyond the buffer. |
| |
| Signed-off-by: Eliad Peller <eliad@wizery.com> |
| Signed-off-by: John W. Linville <linville@tuxdriver.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/wireless/nl80211.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/net/wireless/nl80211.c |
| +++ b/net/wireless/nl80211.c |
| @@ -74,8 +74,8 @@ static struct nla_policy nl80211_policy[ |
| [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, |
| [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, |
| |
| - [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN }, |
| - [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN }, |
| + [NL80211_ATTR_MAC] = { .len = ETH_ALEN }, |
| + [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN }, |
| |
| [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, |
| [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, |
