From 6c05e2aac50fc009e0c6fa16fcace0411411c640 Mon Sep 17 00:00:00 2001 From: Emmanuel Grumbach Date: Tue, 22 Sep 2026 13:37:17 +0300 Subject: [PATCH] wifi: cfg80211: require zero terminator in valid_regdb country table valid_regdb() walks the regulatory.db country table and returns true as soon as either: - a zero coll_ptr entry (the required terminator) is found, or - the next country entry would no longer fit in the buffer. The second case silently accepts a database image whose country table reaches the end of the buffer without a zero-terminator. The callers of valid_regdb() assume that every country is zero terminated. Exit immediately upon zero terminator, don't accept a database without a zero terminator. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260922133709.3d75b1440a1b.Ib92fa3a47e4cd5109c6139e9a4aac85c50f9be22@changeid Signed-off-by: Johannes Berg --- net/wireless/reg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/wireless/reg.c b/net/wireless/reg.c index 035b95508565..b7ef479a74f0 100644 --- a/net/wireless/reg.c +++ b/net/wireless/reg.c @@ -820,13 +820,13 @@ static bool valid_regdb(const u8 *data, unsigned int size) country = &hdr->country[0]; while ((u8 *)(country + 1) <= data + size) { if (!country->coll_ptr) - break; + return true; if (!valid_country(data, size, country)) return false; country++; } - return true; + return false; } static void set_wmm_rule(const struct fwdb_header *db,