nl80211: take RCU read lock when calling ieee80211_bss_get_ie()
commit 7a94b8c2eee7083ddccd0515830f8c81a8e44b1a upstream. As ieee80211_bss_get_ie() derefences an RCU to return ssid_ie, both the call to this function and any operation on this variable need protection by the RCU read lock. Fixes: 44905265bc15 ("nl80211: don't expose wdev->ssid for most interfaces") Change-Id: I7d9c6c32135f4be34678537653787654d435116e Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
This commit is contained in:
parent
ef2a414dd5
commit
72ffcc4d1e
|
@ -2323,12 +2323,13 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flag
|
|||
const u8 *ssid_ie;
|
||||
if (!wdev->current_bss)
|
||||
break;
|
||||
rcu_read_lock();
|
||||
ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
|
||||
WLAN_EID_SSID);
|
||||
if (!ssid_ie)
|
||||
break;
|
||||
if (nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
|
||||
goto nla_put_failure_locked;
|
||||
if (ssid_ie &&
|
||||
nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
|
||||
goto nla_put_failure_rcu_locked;
|
||||
rcu_read_unlock();
|
||||
break;
|
||||
}
|
||||
default:
|
||||
|
@ -2339,6 +2340,8 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flag
|
|||
|
||||
return genlmsg_end(msg, hdr);
|
||||
|
||||
nla_put_failure_rcu_locked:
|
||||
rcu_read_unlock();
|
||||
nla_put_failure_locked:
|
||||
wdev_unlock(wdev);
|
||||
nla_put_failure:
|
||||
|
|
Loading…
Reference in New Issue