From: Johannes Berg Date: Wed, 19 Jun 2013 08:09:57 +0000 (+0200) Subject: nl80211: fix attrbuf access race by allocating a separate one X-Git-Tag: v3.10~13^2~34^2^2 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3a5a423bb958ad22eeccca66c533e85bf69ba10e;p=pandora-kernel.git nl80211: fix attrbuf access race by allocating a separate one Since my commit 3713b4e364 ("nl80211: allow splitting wiphy information in dumps"), nl80211_dump_wiphy() uses the global nl80211_fam.attrbuf for parsing the incoming data. This wouldn't be a problem if it only did so on the first dump iteration which is locked against other commands in generic netlink, but due to space constraints in cb->args (the needed state doesn't fit) I decided to always parse the original message. That's racy though since nl80211_fam.attrbuf could be used by some other parsing in generic netlink concurrently. For now, fix this by allocating a separate parse buffer (it's a bit too big for the stack, currently 1448 bytes on 64-bit). For -next, I'll change the code to parse into the global buffer in the first round only and then allocate a smaller buffer to keep the data in cb->args. Reported-by: Linus Torvalds Acked-by: David S. Miller Acked-by: John W. Linville Signed-off-by: Johannes Berg --- Reading git-diff-tree failed