From: Johannes Berg <johannes.berg@intel.com>
Date: Tue, 15 Jan 2019 13:24:23 +0000 (+0100)
Subject: mac80211_hwsim: check that n_limits makes sense
X-Git-Tag: v5.4-rc1~1723^2~1^2~7
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=9c5d3afac436beef91b7a6312068e9360c7d8446;p=platform%2Fkernel%2Flinux-rpi.git

mac80211_hwsim: check that n_limits makes sense

Under certain circumstances, radios created via netlink could
have n_limits be zero and no possible interface types, which
makes no sense. Reject this early to prevent a WARN_ON() in
cfg80211.

Fixes: 99e3a44bac37 ("mac80211_hwsim: allow setting iftype support")
Reported-by: syzbot+73fd8b0aa60c67fa4b60@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 3a4b878..320edca 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2761,6 +2761,11 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
 					BIT(NL80211_CHAN_WIDTH_160);
 	}
 
+	if (!n_limits) {
+		err = -EINVAL;
+		goto failed_hw;
+	}
+
 	data->if_combination.n_limits = n_limits;
 	data->if_combination.max_interfaces = 2048;
 	data->if_combination.limits = data->if_limits;