linux/net/wireless
Dmitry Ivanov 8f815cdde3 nl80211: check netlink protocol in socket release notification
A non-privileged user can create a netlink socket with the same port_id as
used by an existing open nl80211 netlink socket (e.g. as used by a hostapd
process) with a different protocol number.

Closing this socket will then lead to the notification going to nl80211's
socket release notification handler, and possibly cause an action such as
removing a virtual interface.

Fix this issue by checking that the netlink protocol is NETLINK_GENERIC.
Since generic netlink has no notifier chain of its own, we can't fix the
problem more generically.

Fixes: 026331c4d9 ("cfg80211/mac80211: allow registering for and sending action frames")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Ivanov <dima@ubnt.com>
[rewrite commit message]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-04-12 15:39:06 +02:00
..
.gitignore
ap.c
chan.c cfg80211: use RTNL locked reg_can_beacon for IR-relaxation 2015-07-17 15:02:02 +02:00
core.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-03-08 12:34:12 -05:00
core.h cfg80211: Remove unused cfg80211_can_use_iftype_chan() 2015-12-04 14:43:32 +01:00
db.txt
debugfs.c
debugfs.h
ethtool.c
genregdb.awk
ibss.c
Kconfig cfg80211: Fix some linguistics in Kconfig 2016-02-24 09:04:23 +01:00
lib80211_crypt_ccmp.c lib80211: ratelimit key index mismatch 2015-12-04 14:43:32 +01:00
lib80211_crypt_tkip.c lib80211: Use skcipher and ahash 2016-01-27 20:36:03 +08:00
lib80211_crypt_wep.c lib80211: Use skcipher and ahash 2016-01-27 20:36:03 +08:00
lib80211.c
Makefile
mesh.c
mlme.c cfg80211/mac80211: use to_delayed_work 2016-01-14 11:13:15 +01:00
nl80211.c nl80211: check netlink protocol in socket release notification 2016-04-12 15:39:06 +02:00
nl80211.h
ocb.c cfg80211: ocb: Fix null pointer deref if join_ocb is unimplemented 2015-12-04 14:43:32 +01:00
radiotap.c cfg80211: add radiotap VHT info to rtap_namespace_sizes 2016-02-24 09:04:41 +01:00
rdev-ops.h cfg80211: Add support for aborting an ongoing scan 2015-12-04 14:43:32 +01:00
reg.c Here's another round of updates for -next: 2016-03-01 17:03:27 -05:00
reg.h
regdb.h
scan.c cfg80211: Add multiple scan plans for scheduled scan 2015-10-13 10:35:26 +02:00
sme.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-03-08 12:34:12 -05:00
sysfs.c
sysfs.h
trace.c
trace.h cfg80211: Add support for aborting an ongoing scan 2015-12-04 14:43:32 +01:00
util.c wireless: use reset to set mac header 2016-03-04 22:45:13 -05:00
wext-compat.c
wext-compat.h
wext-core.c cfg80211/wext: fix message ordering 2016-01-29 17:13:43 +01:00
wext-priv.c
wext-proc.c
wext-sme.c
wext-spy.c