cfg80211: reject channels/chandefs with KHz offset >= 1000

This should be covered by the next MHz, make sure that the
numbers are always normalized.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Link: https://lore.kernel.org/r/20200424120103.12b91ecf75f9.I4bf499d58404283bbfacb517d614a816763bccf2@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index d60e50a3b910ccbad7b6d42b221813b9e6fd9932..e111c08daa0e69d7a40698137a52e94044496bb0 100644 (file)
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -147,6 +147,9 @@ bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef)
        if (!chandef->chan)
                return false;
 
+       if (chandef->freq1_offset >= 1000)
+               return false;
+
        control_freq = chandef->chan->center_freq;
 
        switch (chandef->width) {

diff --git a/net/wireless/core.c b/net/wireless/core.c
index 5757dea2aa94abc48f0bc7890cb99e601c806147..b795f363d004a5c6a450922745c966399ef32b5c 100644 (file)
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -834,6 +834,9 @@ int wiphy_register(struct wiphy *wiphy)
                        sband->channels[i].orig_mpwr =
                                sband->channels[i].max_power;
                        sband->channels[i].band = band;
+
+                       if (WARN_ON(sband->channels[i].freq_offset >= 1000))
+                               return -EINVAL;
                }
 
                for (i = 0; i < sband->n_iftype_data; i++) {