Re: NETLINK_URELEASE non-bound socket problem (was: [PATCH] Fix local DoS in cfg80211 subsystem)
On Wed, 2016-04-06 at 11:20 +0300, Dmitrijs Ivanovs wrote: > Hi Johannes! > > I will prepare patch which does not send NETLINK_URELEASE for unbound > sockets as you suggest. But I think protocol check in nl80211 is > still needed because port_id is unique per-protocol. > Yes, good point. Can you please send that as a separate patch? That one should have a Fixes: 026331c4d9b5 ("cfg80211/mac80211: allow registering for and sending action frames") tag. I'll apply this one right away, but the other one should probably go through Dave's tree. Thanks, johannes -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: NETLINK_URELEASE non-bound socket problem (was: [PATCH] Fix local DoS in cfg80211 subsystem)
Hi Johannes! I will prepare patch which does not send NETLINK_URELEASE for unbound sockets as you suggest. But I think protocol check in nl80211 is still needed because port_id is unique per-protocol. On Tue, Apr 5, 2016 at 12:56 PM, Johannes Bergwrote: > Hi Dmitrijs, > > Thanks for reporting this problem. > >> The patch below corrects this problem in kernel space. > > I don't think that this is correct, there are four more users of > NETLINK_URELEASE (nfnetlink, NFC), and afaict all of them have the same > bug as nl80211. > > Rather than fix all of them, I think we should simply not report > NETLINK_URELEASE for netlink sockets that weren't bound; if any user > comes up that requires them later we could add a new event instead. > > I can't find what commit introduced this code, it goes back before git > history, so I don't have the commit log. Maybe it was done for > nfnetlink log/queue? Certainly both nl80211 and NFC are much newer. > >> Also, it is >> recommended to ensure that user-space applications are not using >> user-supplied port_id for netlink sockets (which is default in >> libnl-tiny for example). > > This I think we should remove from the commit log - it's misleading and > there's no point. > > johannes > -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
NETLINK_URELEASE non-bound socket problem (was: [PATCH] Fix local DoS in cfg80211 subsystem)
Hi Dmitrijs, Thanks for reporting this problem. > The patch below corrects this problem in kernel space. I don't think that this is correct, there are four more users of NETLINK_URELEASE (nfnetlink, NFC), and afaict all of them have the same bug as nl80211. Rather than fix all of them, I think we should simply not report NETLINK_URELEASE for netlink sockets that weren't bound; if any user comes up that requires them later we could add a new event instead. I can't find what commit introduced this code, it goes back before git history, so I don't have the commit log. Maybe it was done for nfnetlink log/queue? Certainly both nl80211 and NFC are much newer. > Also, it is > recommended to ensure that user-space applications are not using > user-supplied port_id for netlink sockets (which is default in > libnl-tiny for example). This I think we should remove from the commit log - it's misleading and there's no point. johannes -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html