Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753863AbcDZUjn (ORCPT ); Tue, 26 Apr 2016 16:39:43 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:58291 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753564AbcDZUZi (ORCPT ); Tue, 26 Apr 2016 16:25:38 -0400 From: Kamal Mostafa To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Dmitry Ivanov , Johannes Berg , Kamal Mostafa Subject: [PATCH 3.19.y-ckt 26/66] nl80211: check netlink protocol in socket release notification Date: Tue, 26 Apr 2016 13:24:17 -0700 Message-Id: <1461702297-7792-27-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1461702297-7792-1-git-send-email-kamal@canonical.com> References: <1461702297-7792-1-git-send-email-kamal@canonical.com> X-Extended-Stable: 3.19 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1633 Lines: 44 3.19.8-ckt20 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: Dmitry Ivanov commit 8f815cdde3e550e10c2736990d791f60c2ce43eb upstream. A non-privileged user can create a netlink socket with the same port_id as used by an existing open nl80211 netlink socket (e.g. as used by a hostapd process) with a different protocol number. Closing this socket will then lead to the notification going to nl80211's socket release notification handler, and possibly cause an action such as removing a virtual interface. Fix this issue by checking that the netlink protocol is NETLINK_GENERIC. Since generic netlink has no notifier chain of its own, we can't fix the problem more generically. Fixes: 026331c4d9b5 ("cfg80211/mac80211: allow registering for and sending action frames") Signed-off-by: Dmitry Ivanov [rewrite commit message] Signed-off-by: Johannes Berg Signed-off-by: Kamal Mostafa --- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 49cc71c..1183635 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -12473,7 +12473,7 @@ static int nl80211_netlink_notify(struct notifier_block * nb, struct wireless_dev *wdev; struct cfg80211_beacon_registration *reg, *tmp; - if (state != NETLINK_URELEASE) + if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) return NOTIFY_DONE; rcu_read_lock(); -- 2.7.4