qiurui/Centos-kernel-stream-9
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git synced 2026-09-09 00:08:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

wifi: nl80211: re-check wiphy netns in testmode and vendor dump continuations

Browse Source 
JIRA: https://issues.redhat.com/browse/RHEL-186475

commit f681502c79173a79c3de16be274eca83e8fd8d3f
Author: Maoyi Xie <maoyixie.tju@gmail.com>
Date:   Wed May 27 21:33:58 2026 +0800

    wifi: nl80211: re-check wiphy netns in testmode and vendor dump continuations
    
    Commit 79240f3f6d76 ("wifi: nl80211: re-check wiphy netns in
    nl80211_prepare_wdev_dump() continuation") fixed one dumpit path that
    looked the wiphy up by index on a later call without confirming it was
    still in the caller's netns. Two more dumpit paths have the same gap.
    
    nl80211_testmode_dump() and nl80211_prepare_vendor_dump() both keep the
    wiphy index in cb->args[] and look it up again on later calls, through
    cfg80211_rdev_by_wiphy_idx() and wiphy_idx_to_wiphy(). The first call
    binds to the caller's netns. A later call does not check it again. In
    between, the wiphy can move to another netns via
    NL80211_CMD_SET_WIPHY_NETNS.
    
    Add the same net_eq() check to both. On a mismatch, return -ENODEV and
    the dump ends.
    
    No mainline driver registers .testmode_dump or
    wiphy_vendor_command.dumpit, so these paths are not reachable today.
    Drivers outside the tree can register either.
    
    Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
    Link: https://patch.msgid.link/20260527133358.2853238-1-maoyixie.tju@gmail.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
This commit is contained in:
Jose Ignacio Tornos Martinez
2026-07-01 13:01:27 +02:00
parent 46343c255c
commit 290b73d78e
1 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/wireless/nl80211.c
+19
View File
@@ -13443,6 +13443,16 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
err = -ENOENT;
goto out_err;
}
/*
* The wiphy may have moved netns between dumpit
* invocations (via NL80211_CMD_SET_WIPHY_NETNS), so
* re-check that it still matches the caller's netns.
*/
if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) {
err = -ENODEV;
goto out_err;
}
} else {
attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
GFP_KERNEL);
@@ -17424,6 +17434,15 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
if (!wiphy)
return -ENODEV;
/*
* The wiphy may have moved netns between dumpit
* invocations (via NL80211_CMD_SET_WIPHY_NETNS), so
* re-check that it still matches the caller's netns.
*/
if (!net_eq(wiphy_net(wiphy), sock_net(skb->sk)))
return -ENODEV;
*rdev = wiphy_to_rdev(wiphy);
*wdev = NULL;