Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 940d0ac9 authored by Johannes Berg's avatar Johannes Berg
Browse files

cfg80211: fix rtnl leak in wiphy dump error cases 



In two wiphy dump error cases, most often when the dump allocation
must be increased, the RTNL is leaked. This quickly results in a
complete system lockup. Release the RTNL correctly.

Reported-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent ea141b75

net/wireless/nl80211.c

+4 −1
Original line number Original line Diff line number Diff line
@@ -1541,8 +1541,10 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb) 
			int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);

			int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);





			netdev = dev_get_by_index(sock_net(skb->sk), ifidx);

			netdev = dev_get_by_index(sock_net(skb->sk), ifidx);

			if (!netdev)

			if (!netdev) {

				rtnl_unlock();

				return -ENODEV;

				return -ENODEV;

			}

			if (netdev->ieee80211_ptr) {

			if (netdev->ieee80211_ptr) {

				dev = wiphy_to_dev(

				dev = wiphy_to_dev(

					netdev->ieee80211_ptr->wiphy);

					netdev->ieee80211_ptr->wiphy);
@@ -1586,6 +1588,7 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb) 
				    !skb->len &&

				    !skb->len &&

				    cb->min_dump_alloc < 4096) {

				    cb->min_dump_alloc < 4096) {

					cb->min_dump_alloc = 4096;

					cb->min_dump_alloc = 4096;

					rtnl_unlock();

					return 1;

					return 1;

				}

				}

				idx--;

				idx--;