lkml.org 
[lkml]   [2016]   [Apr]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.2.y-ckt 39/93] nl80211: check netlink protocol in socket release notification
    Date
    4.2.8-ckt9 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: Dmitry Ivanov <dmitrijs.ivanovs@ubnt.com>

    commit 8f815cdde3e550e10c2736990d791f60c2ce43eb upstream.

    A non-privileged user can create a netlink socket with the same port_id as
    used by an existing open nl80211 netlink socket (e.g. as used by a hostapd
    process) with a different protocol number.

    Closing this socket will then lead to the notification going to nl80211's
    socket release notification handler, and possibly cause an action such as
    removing a virtual interface.

    Fix this issue by checking that the netlink protocol is NETLINK_GENERIC.
    Since generic netlink has no notifier chain of its own, we can't fix the
    problem more generically.

    Fixes: 026331c4d9b5 ("cfg80211/mac80211: allow registering for and sending action frames")
    Signed-off-by: Dmitry Ivanov <dima@ubnt.com>
    [rewrite commit message]
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    net/wireless/nl80211.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    index d059cf3..517ecf1 100644
    --- a/net/wireless/nl80211.c
    +++ b/net/wireless/nl80211.c
    @@ -12780,7 +12780,7 @@ static int nl80211_netlink_notify(struct notifier_block * nb,
    struct wireless_dev *wdev;
    struct cfg80211_beacon_registration *reg, *tmp;

    - if (state != NETLINK_URELEASE)
    + if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
    return NOTIFY_DONE;

    rcu_read_lock();
    --
    2.7.4
    \
     
     \ /
      Last update: 2016-04-26 20:41    [W:4.126 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site