openstlinux/linux-st
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
408a93a2bb4f276f28059b51fbe0bbd06be350fc
linux-st/net/wireless
History
Anant Thazhemadam 3dc289f8f1 net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() 
In nl80211_parse_key(), key.idx is first initialized as -1.
If this value of key.idx remains unmodified and gets returned, and
nl80211_key_allowed() also returns 0, then rdev_del_key() gets called
with key.idx = -1.
This causes an out-of-bounds array access.

Handle this issue by checking if the value of key.idx after
nl80211_parse_key() is called and return -EINVAL if key.idx < 0.

Cc: stable@vger.kernel.org
Reported-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Tested-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201007035401.9522-1-anant.thazhemadam@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2020-10-08 12:37:25 +02:00
..
certs
…
.gitignore
.gitignore: add SPDX License Identifier
2020-03-25 11:50:48 +01:00
ap.c
…
chan.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-09-03 18:50:48 -07:00
core.c
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
core.h
cfg80211: fix management registrations deadlock
2020-06-05 09:22:00 +02:00
debugfs.c
…
debugfs.h
…
ethtool.c
cfg80211: check wiphy driver existence for drvinfo report
2020-02-07 12:53:26 +01:00
ibss.c
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
Kconfig
lib80211: fix unmet direct dependendices config warning when !CRYPTO
2020-09-18 11:37:24 +02:00
lib80211_crypt_ccmp.c
…
lib80211_crypt_tkip.c
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
lib80211_crypt_wep.c
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
lib80211.c
…
Makefile
…
mesh.c
cfg80211/mac80211: add mesh_param "mesh_nolearn" to skip path discovery
2020-07-31 09:24:23 +02:00
mlme.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
nl80211.c
net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()
2020-10-08 12:37:25 +02:00
nl80211.h
nl80211: link recursive netlink nested policy
2020-04-30 17:51:41 -07:00
ocb.c
…
of.c
…
pmsr.c
nl80211: link recursive netlink nested policy
2020-04-30 17:51:41 -07:00
radiotap.c
docs: networking: convert radiotap-headers.txt to ReST
2020-04-30 12:56:37 -07:00
rdev-ops.h
nl80211: add ability to report TX status for control port TX
2020-05-27 10:02:04 +02:00
reg.c
cfg80211: regulatory: reject invalid hints
2020-08-27 10:53:14 +02:00
reg.h
…
scan.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
sme.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
sysfs.c
…
sysfs.h
…
trace.c
…
trace.h
cfg80211/mac80211: add mesh_param "mesh_nolearn" to skip path discovery
2020-07-31 09:24:23 +02:00
util.c
cfg80211: fix 6 GHz channel conversion
2020-09-18 11:43:46 +02:00
wext-compat.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
wext-compat.h
…
wext-core.c
…
wext-priv.c
…
wext-proc.c
…
wext-sme.c
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
wext-spy.c
…