Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-17 18:56:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
linux-stable/net/wireless
History
Anant Thazhemadam 3dc289f8f1 net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() 
In nl80211_parse_key(), key.idx is first initialized as -1.
If this value of key.idx remains unmodified and gets returned, and
nl80211_key_allowed() also returns 0, then rdev_del_key() gets called
with key.idx = -1.
This causes an out-of-bounds array access.

Handle this issue by checking if the value of key.idx after
nl80211_parse_key() is called and return -EINVAL if key.idx < 0.

Cc: stable@vger.kernel.org
Reported-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Tested-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201007035401.9522-1-anant.thazhemadam@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2020-10-08 12:37:25 +02:00
..
certs
cfg80211: ship certificates as hex files
2017-12-19 09:28:01 +01:00
.gitignore
.gitignore: add SPDX License Identifier
2020-03-25 11:50:48 +01:00
ap.c
cfg80211: call disconnect_wk when AP stops
2019-02-01 11:12:50 +01:00
chan.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-09-03 18:50:48 -07:00
core.c
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
core.h
cfg80211: fix management registrations deadlock
2020-06-05 09:22:00 +02:00
debugfs.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
debugfs.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
ethtool.c
cfg80211: check wiphy driver existence for drvinfo report
2020-02-07 12:53:26 +01:00
ibss.c
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
Kconfig
lib80211: fix unmet direct dependendices config warning when !CRYPTO
2020-09-18 11:37:24 +02:00
lib80211_crypt_ccmp.c
lib80211: use crypto API ccm(aes) transform for CCMP processing
2019-07-26 13:22:47 +02:00
lib80211_crypt_tkip.c
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
lib80211_crypt_wep.c
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
lib80211.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
Makefile
wireless: Skip directory when generating certificates
2019-05-14 10:27:57 +02:00
mesh.c
cfg80211/mac80211: add mesh_param "mesh_nolearn" to skip path discovery
2020-07-31 09:24:23 +02:00
mlme.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
nl80211.c
net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()
2020-10-08 12:37:25 +02:00
nl80211.h
nl80211: link recursive netlink nested policy
2020-04-30 17:51:41 -07:00
ocb.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
of.c
cfg80211: support ieee80211-freq-limit DT property
2017-01-06 14:01:13 +01:00
pmsr.c
nl80211: link recursive netlink nested policy
2020-04-30 17:51:41 -07:00
radiotap.c
docs: networking: convert radiotap-headers.txt to ReST
2020-04-30 12:56:37 -07:00
rdev-ops.h
nl80211: add ability to report TX status for control port TX
2020-05-27 10:02:04 +02:00
reg.c
cfg80211: regulatory: reject invalid hints
2020-08-27 10:53:14 +02:00
reg.h
net: Fix various misspellings of "connect"
2019-10-28 13:41:59 -07:00
scan.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
sme.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
sysfs.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 432
2019-06-05 17:37:16 +02:00
sysfs.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
trace.c
cfg80211: add tracing to rdev-ops
2012-10-18 10:53:37 +02:00
trace.h
cfg80211/mac80211: add mesh_param "mesh_nolearn" to skip path discovery
2020-07-31 09:24:23 +02:00
util.c
cfg80211: fix 6 GHz channel conversion
2020-09-18 11:43:46 +02:00
wext-compat.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
wext-compat.h
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
wext-core.c
wireless: wext: avoid gcc -O3 warning
2020-01-15 09:52:20 +01:00
wext-priv.c
wext: fix potential private ioctl memory content leak
2010-09-20 13:41:40 -04:00
wext-proc.c
proc: introduce proc_create_net{,_data}
2018-05-16 07:24:30 +02:00
wext-sme.c
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
wext-spy.c
wireless: Convert compare_ether_addr to ether_addr_equal
2012-05-09 20:49:19 -04:00