[PATCH wireless] wifi: cfg80211: check name length before rfkill copies it

[Paolo Bertinetti]

syzbot reports a WARN when mac80211_hwsim creates a radio with a
very long name:

  add_uevent_var: buffer size too small
  WARNING: lib/kobject_uevent.c:688 at add_uevent_var+0x2db/0x460
  Call Trace:
   rfkill_dev_uevent+0x2f/0x1f0
   rfkill_register+0x170/0x9b0
   wiphy_register+0x2a5f/0x3290
   ieee80211_register_hw+0x3d72/0x4b30
   mac80211_hwsim_new_radio+0x32f1/0x5990

Since commit b6c27cf5fe5d ("wifi: cfg80211: check wiphy name in
wiphy_register()"), the name is only checked there, but wiphy_new_nm()
already passes it to rfkill_alloc(), which copies it. A name longer
than NL80211_WIPHY_NAME_MAXLEN thus ends up in the rfkill uevent,
which is what the limit was added to prevent.

The length check depends only on the name and cannot race, so do it
in wiphy_new_nm() before rfkill_alloc().

Fixes: b6c27cf5fe5d ("wifi: cfg80211: check wiphy name in wiphy_register()")
Reported-by: syzbot+56f5119a6b206041a6b7@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=56f5119a6b206041a6b7
Assisted-by: LLM
Signed-off-by: Paolo Bertinetti <paolobertinetti200f4@xxxxxxxxx>
---

Notes:
    Tested in QEMU on v7.4-rc1: a 6000 byte hwsim name no longer WARNs
    and the rfkill gets the phy%d name of the wiphy. cfg80211/mac80211
    KUnit tests pass.
    
    Duplicate or phy<N> names still reach rfkill unchanged. That is
    cosmetic, and fixing it needs rfkill allocated later or renamed.
    
    Based on v7.4-rc1, wireless.git doesn't have b6c27cf5fe5d yet.

 net/wireless/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/wireless/core.c b/net/wireless/core.c
index f4153c249599..d2868e57a030 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -662,6 +662,7 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
 
 	/* remember the name, used/checked during registration */
 	if (!requested_name || !requested_name[0] ||
+	    strlen(requested_name) > NL80211_WIPHY_NAME_MAXLEN ||
 	    dev_set_name(&rdev->wiphy.dev, "%s", requested_name)) {
 		int rv;
 

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.53.0