iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
0da1ccbbef
linux/net/wireless
History
Anant Thazhemadam 3dc289f8f1 net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() 
In nl80211_parse_key(), key.idx is first initialized as -1.
If this value of key.idx remains unmodified and gets returned, and
nl80211_key_allowed() also returns 0, then rdev_del_key() gets called
with key.idx = -1.
This causes an out-of-bounds array access.

Handle this issue by checking if the value of key.idx after
nl80211_parse_key() is called and return -EINVAL if key.idx < 0.

Cc: stable@vger.kernel.org
Reported-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Tested-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201007035401.9522-1-anant.thazhemadam@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2020-10-08 12:37:25 +02:00
..
certs
.gitignore .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
ap.c cfg80211: call disconnect_wk when AP stops 2019-02-01 11:12:50 +01:00
chan.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-09-03 18:50:48 -07:00
core.c mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
core.h cfg80211: fix management registrations deadlock 2020-06-05 09:22:00 +02:00
debugfs.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
debugfs.h
ethtool.c cfg80211: check wiphy driver existence for drvinfo report 2020-02-07 12:53:26 +01:00
ibss.c mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
Kconfig lib80211: fix unmet direct dependendices config warning when !CRYPTO 2020-09-18 11:37:24 +02:00
lib80211_crypt_ccmp.c lib80211: use crypto API ccm(aes) transform for CCMP processing 2019-07-26 13:22:47 +02:00
lib80211_crypt_tkip.c mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
lib80211_crypt_wep.c mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
lib80211.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
Makefile wireless: Skip directory when generating certificates 2019-05-14 10:27:57 +02:00
mesh.c cfg80211/mac80211: add mesh_param "mesh_nolearn" to skip path discovery 2020-07-31 09:24:23 +02:00
mlme.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
nl80211.c net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() 2020-10-08 12:37:25 +02:00
nl80211.h nl80211: link recursive netlink nested policy 2020-04-30 17:51:41 -07:00
ocb.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
of.c
pmsr.c nl80211: link recursive netlink nested policy 2020-04-30 17:51:41 -07:00
radiotap.c docs: networking: convert radiotap-headers.txt to ReST 2020-04-30 12:56:37 -07:00
rdev-ops.h nl80211: add ability to report TX status for control port TX 2020-05-27 10:02:04 +02:00
reg.c cfg80211: regulatory: reject invalid hints 2020-08-27 10:53:14 +02:00
reg.h net: Fix various misspellings of "connect" 2019-10-28 13:41:59 -07:00
scan.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
sme.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
sysfs.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 432 2019-06-05 17:37:16 +02:00
sysfs.h
trace.c
trace.h cfg80211/mac80211: add mesh_param "mesh_nolearn" to skip path discovery 2020-07-31 09:24:23 +02:00
util.c cfg80211: fix 6 GHz channel conversion 2020-09-18 11:43:46 +02:00
wext-compat.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
wext-compat.h treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00
wext-core.c wireless: wext: avoid gcc -O3 warning 2020-01-15 09:52:20 +01:00
wext-priv.c
wext-proc.c
wext-sme.c mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
wext-spy.c