nl80211: fix another nl80211_fam.attrbuf race
This should fix a bug which broke networking for me twice in the last day. svn path=/dists/sid/linux/; revision=20438
This commit is contained in:
parent
61b7114d86
commit
2bfb395c29
|
@ -31,6 +31,7 @@ linux (3.10.4-1) UNRELEASED; urgency=low
|
|||
* [sparc] cpufreq: Convince genksyms that the ABI didn't change
|
||||
(fixes FTBFS)
|
||||
* [hppa] udeb: Add core-modules package (Closes: #718270)
|
||||
* nl80211: fix another nl80211_fam.attrbuf race
|
||||
|
||||
-- Ben Hutchings <ben@decadent.org.uk> Tue, 30 Jul 2013 18:09:20 +0200
|
||||
|
||||
|
|
38
debian/patches/bugfix/all/nl80211-fix-another-nl80211_fam-attrbuf-race.patch
vendored
Normal file
38
debian/patches/bugfix/all/nl80211-fix-another-nl80211_fam-attrbuf-race.patch
vendored
Normal file
|
@ -0,0 +1,38 @@
|
|||
From: Johannes Berg <johannes.berg@intel.com>
|
||||
Date: Tue, 30 Jul 2013 22:38:42 +0200
|
||||
Subject: nl80211: fix another nl80211_fam.attrbuf race
|
||||
Origin: https://git.kernel.org/cgit/linux/kernel/git/jberg/mac80211.git/commit/?id=c319d50bfcf678c2857038276d9fab3c6646f3bf
|
||||
|
||||
This is similar to the race Linus had reported, but in this case
|
||||
it's an older bug: nl80211_prepare_wdev_dump() uses the wiphy
|
||||
index in cb->args[0] as it is and thus parses the message over
|
||||
and over again instead of just once because 0 is the first valid
|
||||
wiphy index. Similar code in nl80211_testmode_dump() correctly
|
||||
offsets the wiphy_index by 1, do that here as well.
|
||||
|
||||
Cc: stable@vger.kernel.org
|
||||
Reported-by: Ben Hutchings <ben@decadent.org.uk>
|
||||
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
||||
---
|
||||
net/wireless/nl80211.c | 6 ++++--
|
||||
1 file changed, 4 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
|
||||
index 25d217d..3fcba69 100644
|
||||
--- a/net/wireless/nl80211.c
|
||||
+++ b/net/wireless/nl80211.c
|
||||
@@ -441,10 +441,12 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
|
||||
goto out_unlock;
|
||||
}
|
||||
*rdev = wiphy_to_dev((*wdev)->wiphy);
|
||||
- cb->args[0] = (*rdev)->wiphy_idx;
|
||||
+ /* 0 is the first index - add 1 to parse only once */
|
||||
+ cb->args[0] = (*rdev)->wiphy_idx + 1;
|
||||
cb->args[1] = (*wdev)->identifier;
|
||||
} else {
|
||||
- struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
|
||||
+ /* subtract the 1 again here */
|
||||
+ struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
|
||||
struct wireless_dev *tmp;
|
||||
|
||||
if (!wiphy) {
|
|
@ -112,3 +112,4 @@ features/all/iwlwifi-bump-required-firmware-API-version-for-3160-.patch
|
|||
bugfix/m68k/ethernat-kconfig.patch
|
||||
|
||||
debian/sparc-cpufreq-convince-genksyms-that-the-abi-didnt-change.patch
|
||||
bugfix/all/nl80211-fix-another-nl80211_fam-attrbuf-race.patch
|
||||
|
|
Loading…
Reference in New Issue