[PATCH net] wifi: cfg80211: reject invalid bss_entries_limit

[Jiacheng Xu]

The writable cfg80211.bss_entries_limit module parameter is currently
parsed by the generic integer parameter setter, which accepts zero and
negative values.

When bss_entries_limit is set to zero, the first new BSS entry satisfies:

    rdev->bss_entries >= bss_entries_limit

This causes __cfg80211_bss_update() to call
cfg80211_bss_expire_oldest() while the BSS list has no eligible entry.
The resulting NULL oldest entry triggers WARN_ON(!oldest).

Add a custom parameter setter that preserves normal integer parsing but
rejects values below one. Register it with module_param_call(), while
preserving the original getter, permissions, compile-time type checking,
and module parameter type metadata.

Update the parameter description to document the minimum value.

Fixes: 9853a55ef1bb ("cfg80211: limit scan results cache size")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiacheng Xu <stitch@xxxxxxxxxx>
---
net/wireless/scan.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)


diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 071083cc3367..a14acc699dc4 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -71,9 +71,27 @@
* entries in total, so overhead is bigger.)
*/
static int bss_entries_limit = 1000;
-module_param(bss_entries_limit, int, 0644);
+
+static int bss_entries_limit_set(const char *val,
+                              const struct kernel_param *kp)
+{
+     int limit, ret;
+
+     ret = kstrtoint(val, 0, &limit);
+     if (ret)
+             return ret;
+     if (limit < 1)
+             return -EINVAL;
+
+     return param_set_int(val, kp);
+}
+
+param_check_int(bss_entries_limit, &bss_entries_limit);
+module_param_call(bss_entries_limit, bss_entries_limit_set,
+               param_get_int, &bss_entries_limit, 0644);
+__MODULE_PARM_TYPE(bss_entries_limit, "int");
MODULE_PARM_DESC(bss_entries_limit,
-                 "limit to number of scan BSS entries (per wiphy, default
1000)");
+              "limit to number of scan BSS entries (per wiphy, default 1000, minimum 1)");


#define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ)