nl80211: fix connect keys range check

[cascardo/linux.git] / net / wireless / nl80211.c

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 4997857..524f5d2 100644 (file)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -866,7 +866,7 @@ nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
                err = -EINVAL;
                if (!parse.p.key)
                        goto error;
-               if (parse.idx < 0 || parse.idx > 4)
+               if (parse.idx < 0 || parse.idx > 3)
                        goto error;
                if (parse.def) {
                        if (def)
@@ -2525,10 +2525,35 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
        int if_idx = 0;
        int wp_start = cb->args[0];
        int if_start = cb->args[1];
+       int filter_wiphy = -1;
        struct cfg80211_registered_device *rdev;
        struct wireless_dev *wdev;
 
        rtnl_lock();
+       if (!cb->args[2]) {
+               struct nl80211_dump_wiphy_state state = {
+                       .filter_wiphy = -1,
+               };
+               int ret;
+
+               ret = nl80211_dump_wiphy_parse(skb, cb, &state);
+               if (ret)
+                       return ret;
+
+               filter_wiphy = state.filter_wiphy;
+
+               /*
+                * if filtering, set cb->args[2] to +1 since 0 is the default
+                * value needed to determine that parsing is necessary.
+                */
+               if (filter_wiphy >= 0)
+                       cb->args[2] = filter_wiphy + 1;
+               else
+                       cb->args[2] = -1;
+       } else if (cb->args[2] > 0) {
+               filter_wiphy = cb->args[2] - 1;
+       }
+
        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
                        continue;
@@ -2536,6 +2561,10 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
                        wp_idx++;
                        continue;
                }
+
+               if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
+                       continue;
+
                if_idx = 0;
 
                list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
@@ -7359,7 +7388,7 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
                    (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
                     key.p.key_len != WLAN_KEY_LEN_WEP104))
                        return -EINVAL;
-               if (key.idx > 4)
+               if (key.idx > 3)
                        return -EINVAL;
        } else {
                key.p.key_len = 0;