lkml.org 
[lkml]   [2014]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.14 209/238] nl80211: clear skb cb before passing to netlink
    Date
    3.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johannes Berg <johannes.berg@intel.com>

    commit bd8c78e78d5011d8111bc2533ee73b13a3bd6c42 upstream.

    In testmode and vendor command reply/event SKBs we use the
    skb cb data to store nl80211 parameters between allocation
    and sending. This causes the code for CONFIG_NETLINK_MMAP
    to get confused, because it takes ownership of the skb cb
    data when the SKB is handed off to netlink, and it doesn't
    explicitly clear it.

    Clear the skb cb explicitly when we're done and before it
    gets passed to netlink to avoid this issue.

    Reported-by: Assaf Azulay <assaf.azulay@intel.com>
    Reported-by: David Spinadel <david.spinadel@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/wireless/nl80211.c | 6 ++++++
    1 file changed, 6 insertions(+)

    --- a/net/wireless/nl80211.c
    +++ b/net/wireless/nl80211.c
    @@ -6796,6 +6796,9 @@ void __cfg80211_send_event_skb(struct sk
    struct nlattr *data = ((void **)skb->cb)[2];
    enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;

    + /* clear CB data for netlink core to own from now on */
    + memset(skb->cb, 0, sizeof(skb->cb));
    +
    nla_nest_end(skb, data);
    genlmsg_end(skb, hdr);

    @@ -9075,6 +9078,9 @@ int cfg80211_vendor_cmd_reply(struct sk_
    void *hdr = ((void **)skb->cb)[1];
    struct nlattr *data = ((void **)skb->cb)[2];

    + /* clear CB data for netlink core to own from now on */
    + memset(skb->cb, 0, sizeof(skb->cb));
    +
    if (WARN_ON(!rdev->cur_cmd_info)) {
    kfree_skb(skb);
    return -EINVAL;



    \
     
     \ /
      Last update: 2014-10-04 00:42    [W:2.537 / U:0.396 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site