• Johannes Berg's avatar
    wifi: nl80211: reject iftype change with mesh ID change · f78c1375
    Johannes Berg authored
    It's currently possible to change the mesh ID when the
    interface isn't yet in mesh mode, at the same time as
    changing it into mesh mode. This leads to an overwrite
    of data in the wdev->u union for the interface type it
    currently has, causing cfg80211_change_iface() to do
    wrong things when switching.
    
    We could probably allow setting an interface to mesh
    while setting the mesh ID at the same time by doing a
    different order of operations here, but realistically
    there's no userspace that's going to do this, so just
    disallow changes in iftype when setting mesh ID.
    
    Cc: stable@vger.kernel.org
    Fixes: 29cbe68c ("cfg80211/mac80211: add mesh join/leave commands")
    Reported-by: syzbot+dd4779978217b1973180@syzkaller.appspotmail.com
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    f78c1375
nl80211.c 551 KB