From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f100.google.com (mail-qv1-f100.google.com [209.85.219.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BDF612D8DB0 for ; Wed, 22 Apr 2026 08:42:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.100 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776847330; cv=none; b=YJsUcIqewphbvCqckCf3rjoz6yQtj77PsiQgeHXrxCsfjilHqxNgioGdoejygGwP+qAYIvdCD2g6Qzij1AIjD3TnjnOfmOEjn4Ggb16Z5dz66Q+j7zp+7q1mzmL01I7NRTGUzvDC/Gc7vqJKHtG/tik8UZU+BFxjEsCcwZvrYiY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776847330; c=relaxed/simple; bh=gWoeKAVK9W7vVlciLjZBHMdToMYeip3zGK7JNfHnd3g=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=G6CBRbsEwSAZDqnnthCwLbLeZrLWnc76cUmECDcYuMbbXKY/ckSSwBkjmZMsKhw+CracvW7PJ/alRSjqyN/yW7/sDPmo3w3fcw0847oCvrroOulMDWrE8My++x0+lQPOc8JR8zBEuf3nFSt/JRcf+Jp+TaQx0GVDceBTj8BtZmE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com; spf=fail smtp.mailfrom=broadcom.com; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b=SXvC8DKW; arc=none smtp.client-ip=209.85.219.100 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=broadcom.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="SXvC8DKW" Received: by mail-qv1-f100.google.com with SMTP id 6a1803df08f44-8a151012558so56829906d6.3 for ; Wed, 22 Apr 2026 01:42:08 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776847328; x=1777452128; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :dkim-signature:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=9QFQoDaEWqT8ApSd3T/yPP9UgkoXGgDXy6M1Q+3Z+F4=; b=rt/7UawDM1Svx9T5Mx9UMfevCljfBPaEVr40ENfKotAt23hNd3QiOAxhjht/xpYA1p RLJJ4fNOm8mBePvBO9egS7xo7WSM1yWWWtQt1+6GNGsKbo7LADKfTuG6eUeOn4X/Reg0 vfrFOgpl6IDeqhIgM/StRiyIw3AZ4rVeaE56RDtzozpVEiTrScvgkMFwozt5VzDTCbyj G97M4Di5zyqmBci58SHgmHPJIOrG/zjUc3/QM/kBr2PaZ0ZMAbdktjz6ETLzk/ikmhKF 1vRUzc+OYxGli6vUUPOrJRCV7Ege5+H32evdhXbur0kc52HGHEA/OO18OuoAXfMX62xH 8o0w== X-Forwarded-Encrypted: i=1; AFNElJ8D4WMlp+gmKGr2lqATg28hQg2uCPtEjSQYgqcX0dRe/eM/9vSye0BSstSfgXBLHcAYdw3dtmztD/ewYpU=@vger.kernel.org X-Gm-Message-State: AOJu0Yw51ooigm41d1KP8Ii65c//EM/6U+UvzyZexGG4H8ZTZOHaYl/X BPytym8a801ra4imL7bGGepJG1fpdrL5QeqLRedhvo/Spp56om6QfoKuoXYnJBuStR3s39dbmNx DKH34CHa0rmCMBqUuaV5WZciWrJJAXOGb7Y01fDECuReuwMgJfYYY1/d3i7u5EXp8JAtyT8SC8C fygDEskYDuGrVYJ+7BBNT78ORhze0T/ahj0x6467trVNZhnJQZz/G5S12tj2HlAImxrXR+1d3o4 c0rGSRRP2ePgOOkpktHADi3Bw== X-Gm-Gg: AeBDieumuErjTYdderMG5xXnJ2aVtWnWtKFqeLSO3yVysYl3ebR84a0msHu61Ky/Bo2 NOEX/1N8SM5rJfyN4AREnlxJCUe2mLEnTmCmxrEDZjiDGhUrcqHT7wBzw5XlcXdklZb9mJvfWyO D1m+7+S1iSogFIr/O08ujjNYzG/5ad7SEB4ix9wRaEaUpk32v55CmIxame1uQanzQS1ihXcJa6Z RXf7Fh9CjvSJjSs98lvhosdw+XfbSNSNMhQn2kBkRw229S2oUCAVz1gCgY3//Lgbe6+HpwG1Mew /joABX0AE5Jad/3yfRVUYVJiBrRZnwgQX1m+P9LE47kv9ud+6yw9dJBID+LUqtCWuYCVjnVuczW Sn6ri11iUjyvJQjaS7sdZy2f2VXFMk2wexMKbXAEw9q4CDhcosiUM4tCD6JqU9NxvTJokVLjeyk nUbJSyvV6GhWPL4rV7oZNMwsHmIy0oZE0ZNkDb7ymqbTrk/fmBSxDesKuBRCptaZIaMYqV3Vc= X-Received: by 2002:a05:6214:400a:b0:89f:123c:4d9c with SMTP id 6a1803df08f44-8b028069551mr319932946d6.18.1776847327550; Wed, 22 Apr 2026 01:42:07 -0700 (PDT) Received: from smtp-us-east1-p01-i01-si01.dlp.protect.broadcom.com (address-144-49-247-24.dlp.protect.broadcom.com. [144.49.247.24]) by smtp-relay.gmail.com with ESMTPS id 6a1803df08f44-8b02ac65c33sm12601616d6.7.2026.04.22.01.42.07 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Apr 2026 01:42:07 -0700 (PDT) X-Relaying-Domain: broadcom.com X-CFilter-Loop: Reflected Received: by mail-qv1-f69.google.com with SMTP id 6a1803df08f44-8acadca1ac4so157519176d6.0 for ; Wed, 22 Apr 2026 01:42:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1776847327; x=1777452127; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=9QFQoDaEWqT8ApSd3T/yPP9UgkoXGgDXy6M1Q+3Z+F4=; b=SXvC8DKWoxbBR3yEIOga3oj2ftxb8++HWmvKaPmDKhad4N2ZLqM+xz2cJ+xSKRcZ/J NcwZkj2KcDMadAgyGCNhjIpNCI/hCVMkLRwf6Vr3puUtTD/hy9BR0b3aWNiD75HqsSJi 3ucVWD9Uq5IbNZzPyJeOBCNVCGpZU1J+jlLL8= X-Forwarded-Encrypted: i=1; AFNElJ9GoT+Sknl5ym/uTZtWd9nNeNhMl5zDKj9RcbXrKEU5G0y6dMS6vPnUupmljJ6r09e6dzv6FabQVi5zlDA=@vger.kernel.org X-Received: by 2002:ac8:5851:0:b0:50e:fcbc:6b7e with SMTP id d75a77b69052e-50efcbc6e9dmr135631971cf.29.1776847326749; Wed, 22 Apr 2026 01:42:06 -0700 (PDT) X-Received: by 2002:ac8:5851:0:b0:50e:fcbc:6b7e with SMTP id d75a77b69052e-50efcbc6e9dmr135631701cf.29.1776847326249; Wed, 22 Apr 2026 01:42:06 -0700 (PDT) Received: from [10.176.2.190] ([192.19.176.227]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8b02ae6133dsm121556606d6.25.2026.04.22.01.42.05 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 22 Apr 2026 01:42:05 -0700 (PDT) Message-ID: <1a3eafb8-f0a3-4da3-bf73-13e8e1a67045@broadcom.com> Date: Wed, 22 Apr 2026 10:42:04 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] wifi: nl80211: require admin perm on SET_PMK / DEL_PMK To: Johannes Berg , Michael Bommarito , linux-wireless@vger.kernel.org Cc: Avraham Stern , linux-kernel@vger.kernel.org References: <20260421224552.4044147-1-michael.bommarito@gmail.com> Content-Language: en-US From: Arend van Spriel In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-DetectorID-Processed: b00c1d49-9d2e-4205-b15f-d015386d3d5e On 22/04/2026 08:23, Johannes Berg wrote: > On Tue, 2026-04-21 at 18:45 -0400, Michael Bommarito wrote: >> >> Both ops were introduced without a .flags gate, so the generic >> netlink layer dispatches them to an unprivileged caller instead >> of rejecting with -EPERM at the permission check. Every other >> connection-state op in the adjacent block (CONNECT, ASSOCIATE, >> AUTHENTICATE, SET_KEY, ...) carries GENL_UNS_ADMIN_PERM; SET_PMK >> / DEL_PMK were introduced without the flag in 2017 and left >> unchanged by later refactors. Johannes checked the original >> Intel submission history and confirmed there is no admin check >> in any prior revision either, so this seems likely to be a >> simple oversight rather than an intentional carve-out. > > FWIW, this submission did originally come from Avi, but we no longer > have a driver using it (it was never upstream anyway), so that now the > only affected driver is brcmfmac, AFAICT (other non-upstream drivers I > wouldn't know, of course.) > > Arend, it does seem like the right thing to do here, but I wanted to > confirm with you and thus asked Michael to CC you, what do you think? I agree. I saw the patch earlier this morning and acked the patch just now. Regards, Arend