Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

nl80211: Don't verify owner_nlportid on NAN commands

If NAN interface is created with NL80211_ATTR_SOCKET_OWNER, the socket
that is used to create the interface is used for all NAN operations and
reporting NAN events.
However, it turns out that sending commands and receiving events on
the same socket is not possible in a completely race-free way:
If the socket buffer is overflowed by the events, the command response
will not be sent. In that case the caller will block forever on recv.
Using non-blocking socket for commands is more complicated and still
the command response or ack may not be received.
So, keep unicasting NAN events to the interface creator, but allow
using a different socket for commands.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

authored by

Andrei Otcheretianski and committed by
Kalle Valo
36a554ce 123fef3f

+4 -13
+4 -5
include/uapi/linux/nl80211.h
··· 1909 1909 * that configured the indoor setting, and the indoor operation would be 1910 1910 * cleared when the socket is closed. 1911 1911 * If set during NAN interface creation, the interface will be destroyed 1912 - * if the socket is closed just like any other interface. Moreover, only 1913 - * the netlink socket that created the interface will be allowed to add 1914 - * and remove functions. NAN notifications will be sent in unicast to that 1915 - * socket. Without this attribute, any socket can add functions and the 1916 - * notifications will be sent to the %NL80211_MCGRP_NAN multicast group. 1912 + * if the socket is closed just like any other interface. Moreover, NAN 1913 + * notifications will be sent in unicast to that socket. Without this 1914 + * attribute, the notifications will be sent to the %NL80211_MCGRP_NAN 1915 + * multicast group. 1917 1916 * If set during %NL80211_CMD_ASSOCIATE or %NL80211_CMD_CONNECT the 1918 1917 * station will deauthenticate when the socket is closed. 1919 1918 *
-8
net/wireless/nl80211.c
··· 11206 11206 if (!info->attrs[NL80211_ATTR_NAN_FUNC]) 11207 11207 return -EINVAL; 11208 11208 11209 - if (wdev->owner_nlportid && 11210 - wdev->owner_nlportid != info->snd_portid) 11211 - return -ENOTCONN; 11212 - 11213 11209 err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX, 11214 11210 info->attrs[NL80211_ATTR_NAN_FUNC], 11215 11211 nl80211_nan_func_policy, info->extack); ··· 11436 11440 11437 11441 if (!info->attrs[NL80211_ATTR_COOKIE]) 11438 11442 return -EINVAL; 11439 - 11440 - if (wdev->owner_nlportid && 11441 - wdev->owner_nlportid != info->snd_portid) 11442 - return -ENOTCONN; 11443 11443 11444 11444 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 11445 11445