39 lines
1.5 KiB
Diff
39 lines
1.5 KiB
Diff
From: Johannes Berg <johannes.berg@intel.com>
|
|
Date: Tue, 30 Jul 2013 22:38:42 +0200
|
|
Subject: nl80211: fix another nl80211_fam.attrbuf race
|
|
Origin: https://git.kernel.org/cgit/linux/kernel/git/jberg/mac80211.git/commit/?id=c319d50bfcf678c2857038276d9fab3c6646f3bf
|
|
|
|
This is similar to the race Linus had reported, but in this case
|
|
it's an older bug: nl80211_prepare_wdev_dump() uses the wiphy
|
|
index in cb->args[0] as it is and thus parses the message over
|
|
and over again instead of just once because 0 is the first valid
|
|
wiphy index. Similar code in nl80211_testmode_dump() correctly
|
|
offsets the wiphy_index by 1, do that here as well.
|
|
|
|
Cc: stable@vger.kernel.org
|
|
Reported-by: Ben Hutchings <ben@decadent.org.uk>
|
|
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
---
|
|
net/wireless/nl80211.c | 6 ++++--
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
|
|
index 25d217d..3fcba69 100644
|
|
--- a/net/wireless/nl80211.c
|
|
+++ b/net/wireless/nl80211.c
|
|
@@ -441,10 +441,12 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
|
|
goto out_unlock;
|
|
}
|
|
*rdev = wiphy_to_dev((*wdev)->wiphy);
|
|
- cb->args[0] = (*rdev)->wiphy_idx;
|
|
+ /* 0 is the first index - add 1 to parse only once */
|
|
+ cb->args[0] = (*rdev)->wiphy_idx + 1;
|
|
cb->args[1] = (*wdev)->identifier;
|
|
} else {
|
|
- struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
|
|
+ /* subtract the 1 again here */
|
|
+ struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
|
|
struct wireless_dev *tmp;
|
|
|
|
if (!wiphy) {
|