diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2018-01-15 09:58:27 +0100 |
|---|---|---|
| committer | Moyster <oysterized@gmail.com> | 2019-05-03 19:27:53 +0200 |
| commit | 8e09c6125e20aa1517a1176cb35a1790b845438b (patch) | |
| tree | baa5aaed26c2a6c45460522667a04ecd375c9761 /net/wireless | |
| parent | ec4eaf79b19452599b0c1b3bbcf8fff81afaa9b7 (diff) | |
cfg80211: check dev_set_name() return value
commit 59b179b48ce2a6076448a44531242ac2b3f6cef2 upstream.
syzbot reported a warning from rfkill_alloc(), and after a while
I think that the reason is that it was doing fault injection and
the dev_set_name() failed, leaving the name NULL, and we didn't
check the return value and got to rfkill_alloc() with a NULL name.
Since we really don't want a NULL name, we ought to check the
return value.
Fixes: fb28ad35906a ("net: struct device - replace bus_id with dev_name(), dev_set_name()")
Change-Id: Iecd16d788290c9d51a62c22a7c2784623aa0abc6
Reported-by: syzbot+1ddfb3357e1d7bb5b5d3@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/core.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/wireless/core.c b/net/wireless/core.c index 0fc9d7531..f1fb0b25e 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -366,6 +366,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv) struct cfg80211_registered_device *rdev; int alloc_size; + int rv; WARN_ON(ops->add_key && (!ops->del_key || !ops->set_default_key)); WARN_ON(ops->auth && (!ops->assoc || !ops->deauth || !ops->disassoc)); @@ -399,7 +400,11 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv) mutex_unlock(&cfg80211_mutex); /* give it a proper name */ - dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx); + rv = dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx); + if (rv < 0) { + kfree(rdev); + return NULL; + } mutex_init(&rdev->mtx); mutex_init(&rdev->devlist_mtx); |