]> www.infradead.org Git - users/jedix/linux-maple.git/commit
nl80211: check netlink protocol in socket release notification
authorDmitry Ivanov <dmitrijs.ivanovs@ubnt.com>
Wed, 6 Apr 2016 14:23:18 +0000 (17:23 +0300)
committerDhaval Giani <dhaval.giani@oracle.com>
Fri, 20 Jan 2017 22:21:48 +0000 (17:21 -0500)
commita3dbeab3e5444e2927e17b2929f9694a2484bd71
treebb4b16e5684e878c5111b2bb3d1e1412b9dbc541
parent5541668854f512936be542afacd04935b6e25dae
nl80211: check netlink protocol in socket release notification

Orabug: 25227127

[ Upstream commit 8f815cdde3e550e10c2736990d791f60c2ce43eb ]

A non-privileged user can create a netlink socket with the same port_id as
used by an existing open nl80211 netlink socket (e.g. as used by a hostapd
process) with a different protocol number.

Closing this socket will then lead to the notification going to nl80211's
socket release notification handler, and possibly cause an action such as
removing a virtual interface.

Fix this issue by checking that the netlink protocol is NETLINK_GENERIC.
Since generic netlink has no notifier chain of its own, we can't fix the
problem more generically.

Fixes: 026331c4d9b5 ("cfg80211/mac80211: allow registering for and sending action frames")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Ivanov <dima@ubnt.com>
[rewrite commit message]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
(cherry picked from commit 2c8c83f64c0fb9764b486f14a08f2e3e51bcbc40)

Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
net/wireless/nl80211.c