From 6913b49a5071064f49f7a74b432286fa735f7612 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 4 Dec 2012 00:48:59 +0100 Subject: [PATCH] regulatory: fix reg_is_valid_request handling There's a bug with the world regulatory domain, it can be updated any time which is different from all other regdomains that can only be updated once after a request for them. Fix this by adding a check for "processed" to the reg_is_valid_request() function and clear that when doing a request. While looking at this I also found another locking bug, last_request is protected by the reg_mutex not the cfg80211_mutex so the code in nl80211 is racy. Remove that code as it only tries to prevent an allocation in an error case, which isn't necessary. Then the function can also become static and locking in nl80211 can have a smaller scope. Also change __set_regdom() to do the checks earlier and not different for world/other regdomains. Acked-by: Luis R. Rodriguez Signed-off-by: Johannes Berg --- net/wireless/nl80211.c | 18 ++++++------------ net/wireless/reg.c | 21 +++++++++++---------- net/wireless/reg.h | 1 - 3 files changed, 17 insertions(+), 23 deletions(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 9c2c918..b387dea 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -4265,21 +4265,12 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info) return -EINVAL; } - mutex_lock(&cfg80211_mutex); - - if (!reg_is_valid_request(alpha2)) { - r = -EINVAL; - goto bad_reg; - } - size_of_regd = sizeof(struct ieee80211_regdomain) + num_rules * sizeof(struct ieee80211_reg_rule); rd = kzalloc(size_of_regd, GFP_KERNEL); - if (!rd) { - r = -ENOMEM; - goto bad_reg; - } + if (!rd) + return -ENOMEM; rd->n_reg_rules = num_rules; rd->alpha2[0] = alpha2[0]; @@ -4309,11 +4300,14 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info) } } + mutex_lock(&cfg80211_mutex); + r = set_regdom(rd); + /* set_regdom took ownership */ rd = NULL; + mutex_unlock(&cfg80211_mutex); bad_reg: - mutex_unlock(&cfg80211_mutex); kfree(rd); return r; } diff --git a/net/wireless/reg.c b/net/wireless/reg.c index 752729e..b3f94c9 100644 --- a/net/wireless/reg.c +++ b/net/wireless/reg.c @@ -425,12 +425,16 @@ static int call_crda(const char *alpha2) return kobject_uevent(®_pdev->dev.kobj, KOBJ_CHANGE); } -/* Used by nl80211 before kmalloc'ing our regulatory domain */ -bool reg_is_valid_request(const char *alpha2) +static bool reg_is_valid_request(const char *alpha2) { + assert_reg_lock(); + if (!last_request) return false; + if (last_request->processed) + return false; + return alpha2_equal(last_request->alpha2, alpha2); } @@ -1470,6 +1474,7 @@ new_request: last_request = pending_request; last_request->intersect = intersect; + last_request->processed = false; pending_request = NULL; @@ -2060,11 +2065,13 @@ static int __set_regdom(const struct ieee80211_regdomain *rd) const struct ieee80211_regdomain *regd; const struct ieee80211_regdomain *intersected_rd = NULL; struct wiphy *request_wiphy; + /* Some basic sanity checks first */ + if (!reg_is_valid_request(rd->alpha2)) + return -EINVAL; + if (is_world_regdom(rd->alpha2)) { - if (WARN_ON(!reg_is_valid_request(rd->alpha2))) - return -EINVAL; update_world_regdomain(rd); return 0; } @@ -2073,9 +2080,6 @@ static int __set_regdom(const struct ieee80211_regdomain *rd) !is_unknown_alpha2(rd->alpha2)) return -EINVAL; - if (!last_request) - return -EINVAL; - /* * Lets only bother proceeding on the same alpha2 if the current * rd is non static (it means CRDA was present and was used last) @@ -2097,9 +2101,6 @@ static int __set_regdom(const struct ieee80211_regdomain *rd) * internal EEPROM data */ - if (WARN_ON(!reg_is_valid_request(rd->alpha2))) - return -EINVAL; - if (!is_valid_rd(rd)) { pr_err("Invalid regulatory domain detected:\n"); print_regdomain_info(rd); diff --git a/net/wireless/reg.h b/net/wireless/reg.h index 37891e8..d391b50d 100644 --- a/net/wireless/reg.h +++ b/net/wireless/reg.h @@ -19,7 +19,6 @@ extern const struct ieee80211_regdomain *cfg80211_regdomain; bool is_world_regdom(const char *alpha2); -bool reg_is_valid_request(const char *alpha2); bool reg_supported_dfs_region(u8 dfs_region); int regulatory_hint_user(const char *alpha2, -- 2.7.4