mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 02:17:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

wifi: nl80211: re-check wiphy netns in testmode and vendor dump continuations

Browse Source 
Commit 79240f3f6d ("wifi: nl80211: re-check wiphy netns in
nl80211_prepare_wdev_dump() continuation") fixed one dumpit path that
looked the wiphy up by index on a later call without confirming it was
still in the caller's netns. Two more dumpit paths have the same gap.

nl80211_testmode_dump() and nl80211_prepare_vendor_dump() both keep the
wiphy index in cb->args[] and look it up again on later calls, through
cfg80211_rdev_by_wiphy_idx() and wiphy_idx_to_wiphy(). The first call
binds to the caller's netns. A later call does not check it again. In
between, the wiphy can move to another netns via
NL80211_CMD_SET_WIPHY_NETNS.

Add the same net_eq() check to both. On a mismatch, return -ENODEV and
the dump ends.

No mainline driver registers .testmode_dump or
wiphy_vendor_command.dumpit, so these paths are not reachable today.
Drivers outside the tree can register either.

Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Link: https://patch.msgid.link/20260527133358.2853238-1-maoyixie.tju@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Maoyi Xie
2026-05-27 21:33:58 +08:00
committed by Johannes Berg
parent db21511218
commit f681502c79
1 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
net/wireless/nl80211.c
View File

@@ -13730,6 +13730,16 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
err = -ENOENT;
goto out_err;
}
/*
* The wiphy may have moved netns between dumpit
* invocations (via NL80211_CMD_SET_WIPHY_NETNS), so
* re-check that it still matches the caller's netns.
*/
if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) {
err = -ENODEV;
goto out_err;
}
} else {
attrbuf = kzalloc_objs(*attrbuf, NUM_NL80211_ATTR);
if (!attrbuf) {
@@ -17771,6 +17781,15 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
if (!wiphy)
return -ENODEV;
/*
* The wiphy may have moved netns between dumpit
* invocations (via NL80211_CMD_SET_WIPHY_NETNS), so
* re-check that it still matches the caller's netns.
*/
if (!net_eq(wiphy_net(wiphy), sock_net(skb->sk)))
return -ENODEV;
*rdev = wiphy_to_rdev(wiphy);
*wdev = NULL;