Skip to content

Commit 7589803

Browse files
jmberg-intelgregkh
authored andcommitted
cfg80211: check dev_set_name() return value
commit 59b179b upstream. syzbot reported a warning from rfkill_alloc(), and after a while I think that the reason is that it was doing fault injection and the dev_set_name() failed, leaving the name NULL, and we didn't check the return value and got to rfkill_alloc() with a NULL name. Since we really don't want a NULL name, we ought to check the return value. Fixes: fb28ad3 ("net: struct device - replace bus_id with dev_name(), dev_set_name()") Reported-by: syzbot+1ddfb3357e1d7bb5b5d3@syzkaller.appspotmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 2bb174a commit 7589803

1 file changed

Lines changed: 7 additions & 1 deletion

File tree

net/wireless/core.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -421,14 +421,20 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
421421
if (rv)
422422
goto use_default_name;
423423
} else {
424+
int rv;
425+
424426
use_default_name:
425427
/* NOTE: This is *probably* safe w/out holding rtnl because of
426428
* the restrictions on phy names. Probably this call could
427429
* fail if some other part of the kernel (re)named a device
428430
* phyX. But, might should add some locking and check return
429431
* value, and use a different name if this one exists?
430432
*/
431-
dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
433+
rv = dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
434+
if (rv < 0) {
435+
kfree(rdev);
436+
return NULL;
437+
}
432438
}
433439

434440
INIT_LIST_HEAD(&rdev->wiphy.wdev_list);

0 commit comments

Comments
 (0)