mac80211: reject zero cookie in mgmt-tx/roc cancel

When cancelling, you can cancel "any" (first in list) mgmt-tx
or remain-on-channel operation by using the value 0 for the
cookie along with the *opposite* operation, i.e.
 * cancel the first mgmt-tx by cancelling roc with 0 cookie
 * cancel the first roc by cancelling mgmt-tx with 0 cookie

This isn't really that bad since userspace should only pass
cookies that we gave it, but could lead to hard-to-debug
issues so better prevent it and reject zero values since we
never hand those out.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index cfd3356e26fdbad3f26503fab2ba9b3ec2b263d5..6719b27aad6651947955f6797d16795e88fe5e8b 100644 (file)
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -697,6 +697,9 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
        struct ieee80211_roc_work *roc, *tmp, *found = NULL;
        int ret;
 
+       if (!cookie)
+               return -ENOENT;
+
        mutex_lock(&local->mtx);
        list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
                if (!mgmt_tx && roc->cookie != cookie)