iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
d7f13f7450
linux/net
History
Srinivas Dasari d7f13f7450 cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES 
validate_scan_freqs() retrieves frequencies from attributes
nested in the attribute NL80211_ATTR_SCAN_FREQUENCIES with
nla_get_u32(), which reads 4 bytes from each attribute
without validating the size of data received. Attributes
nested in NL80211_ATTR_SCAN_FREQUENCIES don't have an nla policy.

Validate size of each attribute before parsing to avoid potential buffer
overread.

Fixes: 2a51931192 ("cfg80211/nl80211: scanning (and mac80211 update to use it)")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Dasari <dasaris@qti.qualcomm.com>
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-07-07 11:24:31 +02:00
..
6lowpan 6lowpan: Don't set IFF_NO_QUEUE 2017-04-12 22:02:40 +02:00
9p xen: fixes for 4.12 rc2 2017-05-19 15:06:48 -07:00
802
8021q net: Fix inconsistent teardown and release of private netdev state. 2017-06-07 15:53:24 -04:00
appletalk
atm neighbour: fix nlmsg_pid in notifications 2017-03-22 10:48:49 -07:00
ax25
batman-adv Here are two batman-adv bugfixes: 2017-06-13 13:46:01 -04:00
bluetooth net: Fix inconsistent teardown and release of private netdev state. 2017-06-07 15:53:24 -04:00
bpf bpf: Align packet data properly in program testing framework. 2017-05-02 11:46:28 -04:00
bridge net: Fix inconsistent teardown and release of private netdev state. 2017-06-07 15:53:24 -04:00
caif caif: Add sockaddr length check before accessing sa_family in connect handler 2017-06-13 16:16:11 -04:00
can can: af_can: namespace support: fix lockdep splat: properly initialize spin_lock 2017-06-09 11:39:23 +02:00
ceph libceph: cleanup old messages according to reconnect seq 2017-05-24 18:10:51 +02:00
core dev_ioctl: copy only the smaller struct iwreq for wext 2017-06-14 13:52:44 +02:00
dcb net: rtnetlink: plumb extended ack to doit function 2017-04-17 15:35:38 -04:00
dccp Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-05-15 15:50:49 -07:00
decnet decnet: always not take dst->__refcnt when inserting dst into hash table 2017-06-16 14:59:36 -04:00
dns_resolver
dsa net: dsa: Fix stale cpu_switch reference after unbind then bind 2017-06-04 22:55:17 -04:00
ethernet
hsr hsr: fix incorrect warning 2017-06-12 15:21:20 -04:00
ieee802154 net: Fix inconsistent teardown and release of private netdev state. 2017-06-07 15:53:24 -04:00
ife
ipv4 ip_tunnel: fix potential issue in ip_tunnel_rcv 2017-06-16 12:01:29 -04:00
ipv6 ip6_tunnel: Correct tos value in collect_md mode 2017-06-18 23:56:57 -04:00
ipx ipx: call ipxitf_put() in ioctl error path 2017-05-02 15:34:53 -04:00
irda net: Fix inconsistent teardown and release of private netdev state. 2017-06-07 15:53:24 -04:00
iucv
kcm kcm: remove a useless copy_from_user() 2017-04-17 13:28:48 -04:00
key af_key: Fix slab-out-of-bounds in pfkey_compile_policy. 2017-05-08 08:03:01 +02:00
l2tp l2tp: cast l2tp traffic counter to unsigned 2017-06-10 16:14:27 -04:00
l3mdev
lapb
llc net: llc: add lock_sock in llc_ui_bind to avoid a race condition 2017-05-26 14:20:29 -04:00
mac80211 Some fixes: 2017-06-13 13:34:13 -04:00
mac802154 net: Fix inconsistent teardown and release of private netdev state. 2017-06-07 15:53:24 -04:00
mpls mpls: fix clearing of dead nh_flags on link up 2017-05-31 14:48:24 -04:00
ncsi
netfilter netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize 2017-05-24 11:26:01 +02:00
netlabel netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
netlink netlink: don't send unknown nsid 2017-06-01 11:49:39 -04:00
netrom
nfc NFC 4.12 pull request 2017-04-21 15:29:40 -04:00
openvswitch net: Fix inconsistent teardown and release of private netdev state. 2017-06-07 15:53:24 -04:00
packet net/packet: fix missing net_device reference release 2017-05-15 14:22:12 -04:00
phonet net: Fix inconsistent teardown and release of private netdev state. 2017-06-07 15:53:24 -04:00
psample
qrtr Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-04-21 20:23:53 -07:00
rds Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2017-05-02 16:40:27 -07:00
rfkill
rose
rxrpc rxrpc: Fix several cases where a padded len isn't checked in ticket decode 2017-06-15 14:23:44 -04:00
sched net/act_pedit: fix an error code 2017-06-14 15:24:18 -04:00
sctp sctp: return next obj by passing pos + 1 into sctp_transport_get_idx 2017-06-15 14:40:30 -04:00
smc net/smc: Add warning about remote memory exposure 2017-05-16 14:49:43 -04:00
strparser
sunrpc SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() 2017-05-31 12:26:44 -04:00
switchdev netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
tipc net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse 2017-06-10 18:20:38 -04:00
unix af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers 2017-06-09 10:10:24 -04:00
vmw_vsock vsock: use new wait API for vsock_stream_sendmsg() 2017-05-22 14:39:36 -04:00
wimax
wireless cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES 2017-07-07 11:24:31 +02:00
x25 net: x25: fix one potential use-after-free issue 2017-05-18 10:05:40 -04:00
xfrm xfrm: fix state migration copy replay sequence numbers 2017-05-19 12:49:13 +02:00
compat.c
Kconfig
Makefile bpf: introduce BPF_PROG_TEST_RUN command 2017-04-01 12:45:57 -07:00
socket.c l2tp: device MTU setup, tunnel socket needs a lock 2017-04-17 13:01:48 -04:00
sysctl_net.c sysctl: Remove dead register_sysctl_root 2017-04-16 23:42:49 -05:00