mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

mac802154: allow only one WPAN to be up at any given time 

All 802.15.4 PHY devices with drivers in tree can support only one WPAN
at any given time, yet the stack allows arbitrarily many WPAN devices to
be created and up at the same time. This cannot work with what the
hardware provides, and in the current implementation, provides an easy
DoS vector to any process on the system that may call socket() and
sendmsg().

Thus, allow only one WPAN per PHY to be up at once, just like mac80211
does for managed devices.

Signed-off-by: Phoebe Buckheister <phoebe.buckheister@itwm.fraunhofer.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Phoebe Buckheister 2014-03-31 21:37:45 +02:00 committed by David S. Miller
parent 01d32f6e5a
commit 336908f6d7
2 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
net/mac802154/ieee802154_dev.c
View File

@ -36,9 +36,28 @@
int mac802154_slave_open(struct net_device *dev)
{
struct mac802154_sub_if_data *priv = netdev_priv(dev);
struct mac802154_sub_if_data *subif;
struct mac802154_priv *ipriv = priv->hw;
int res = 0;
ASSERT_RTNL();
if (priv->type == IEEE802154_DEV_WPAN) {
mutex_lock(&priv->hw->slaves_mtx);
list_for_each_entry(subif, &priv->hw->slaves, list) {
if (subif != priv && subif->type == priv->type &&
subif->running) {
mutex_unlock(&priv->hw->slaves_mtx);
return -EBUSY;
}
}
mutex_unlock(&priv->hw->slaves_mtx);
}
mutex_lock(&priv->hw->slaves_mtx);
priv->running = true;
mutex_unlock(&priv->hw->slaves_mtx);
if (ipriv->open_count++ == 0) {
res = ipriv->ops->start(&ipriv->hw);
WARN_ON(res);
@ -69,8 +88,14 @@ int mac802154_slave_close(struct net_device *dev)
struct mac802154_sub_if_data *priv = netdev_priv(dev);
struct mac802154_priv *ipriv = priv->hw;
ASSERT_RTNL();
netif_stop_queue(dev);
mutex_lock(&priv->hw->slaves_mtx);
priv->running = false;
mutex_unlock(&priv->hw->slaves_mtx);
if (!--ipriv->open_count)
ipriv->ops->stop(&ipriv->hw);

1
net/mac802154/mac802154.h
View File

@ -71,6 +71,7 @@ struct mac802154_sub_if_data {
struct net_device *dev;
int type;
bool running;
spinlock_t mib_lock;