From: Dmitry Ivanov Date: Wed, 6 Apr 2016 14:23:18 +0000 (+0300) Subject: nl80211: check netlink protocol in socket release notification X-Git-Tag: v3.10.102~58 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3af67b1b6b4d3dc6e05bdb76aa1a3d2c4f185630;p=thirdparty%2Fkernel%2Fstable.git nl80211: check netlink protocol in socket release notification commit 8f815cdde3e550e10c2736990d791f60c2ce43eb upstream. A non-privileged user can create a netlink socket with the same port_id as used by an existing open nl80211 netlink socket (e.g. as used by a hostapd process) with a different protocol number. Closing this socket will then lead to the notification going to nl80211's socket release notification handler, and possibly cause an action such as removing a virtual interface. Fix this issue by checking that the netlink protocol is NETLINK_GENERIC. Since generic netlink has no notifier chain of its own, we can't fix the problem more generically. Fixes: 026331c4d9b5 ("cfg80211/mac80211: allow registering for and sending action frames") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Ivanov [rewrite commit message] Signed-off-by: Johannes Berg Signed-off-by: Willy Tarreau --- diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 90a0e552cb32a..dd3dbed89c8f0 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -10685,7 +10685,7 @@ static int nl80211_netlink_notify(struct notifier_block * nb, struct wireless_dev *wdev; struct cfg80211_beacon_registration *reg, *tmp; - if (state != NETLINK_URELEASE) + if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) return NOTIFY_DONE; rcu_read_lock();