1
0
Fork 0
alistair23-linux/net/wireless
Anant Thazhemadam 8ece83bf75 net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()
commit 3dc289f8f1 upstream.

In nl80211_parse_key(), key.idx is first initialized as -1.
If this value of key.idx remains unmodified and gets returned, and
nl80211_key_allowed() also returns 0, then rdev_del_key() gets called
with key.idx = -1.
This causes an out-of-bounds array access.

Handle this issue by checking if the value of key.idx after
nl80211_parse_key() is called and return -EINVAL if key.idx < 0.

Cc: stable@vger.kernel.org
Reported-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Tested-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201007035401.9522-1-anant.thazhemadam@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-14 10:32:57 +02:00
..
certs cfg80211: ship certificates as hex files 2017-12-19 09:28:01 +01:00
.gitignore cfg80211: implement regdb signature checking 2017-10-11 14:24:24 +02:00
Kconfig lib80211: fix unmet direct dependendices config warning when !CRYPTO 2020-10-01 13:18:20 +02:00
Makefile wireless: Skip directory when generating certificates 2019-05-14 10:27:57 +02:00
ap.c cfg80211: call disconnect_wk when AP stops 2019-02-01 11:12:50 +01:00
chan.c nl80211: Disallow setting of HT for channel 14 2019-10-30 10:07:22 +01:00
core.c cfg80211: fix debugfs rename crash 2020-06-03 08:21:29 +02:00
core.h cfg80211: always shut down on HW rfkill 2019-09-11 09:13:26 +02:00
debugfs.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
debugfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ethtool.c cfg80211: check wiphy driver existence for drvinfo report 2020-03-05 16:43:36 +01:00
ibss.c cfg80211: ibss: use 11a mandatory rates for 6GHz band operation 2019-08-21 10:54:57 +02:00
lib80211.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
lib80211_crypt_ccmp.c lib80211: use crypto API ccm(aes) transform for CCMP processing 2019-07-26 13:22:47 +02:00
lib80211_crypt_tkip.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
lib80211_crypt_wep.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
mesh.c nl80211: Add SOCKET_OWNER support to JOIN_MESH 2018-03-29 10:38:24 +02:00
mlme.c cfg80211: Report Association Request frame IEs in association events 2019-02-22 13:35:09 +01:00
nl80211.c net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() 2020-10-14 10:32:57 +02:00
nl80211.h cfg80211: Report Association Request frame IEs in association events 2019-02-22 13:35:09 +01:00
ocb.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
of.c cfg80211: support ieee80211-freq-limit DT property 2017-01-06 14:01:13 +01:00
pmsr.c cfg80211: report measurement start TSF correctly 2019-06-14 15:46:33 +02:00
radiotap.c cfg80211: add radiotap VHT info to rtap_namespace_sizes 2016-02-24 09:04:41 +01:00
rdev-ops.h cfg80211: Fix radar event during another phy CAC 2020-02-05 21:22:46 +00:00
reg.c cfg80211: regulatory: reject invalid hints 2020-09-09 19:12:37 +02:00
reg.h mac80211: fix scan when operating on DFS channels in ETSI domains 2019-10-07 22:10:50 +02:00
scan.c cfg80211: Do not warn on same channel at the end of CSA 2020-04-17 10:49:59 +02:00
sme.c cfg80211: fix deadlocks in autodisconnect work 2020-01-23 08:22:46 +01:00
sysfs.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 432 2019-06-05 17:37:16 +02:00
sysfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
trace.c
trace.h cfg80211: Fix radar event during another phy CAC 2020-02-05 21:22:46 +00:00
util.c cfg80211: Adjust 6 GHz frequency to channel conversion 2020-09-17 13:47:46 +02:00
wext-compat.c cfg80211: initialize on-stack chandefs 2019-10-01 17:56:18 +02:00
wext-compat.h treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00
wext-core.c wireless: wext: avoid gcc -O3 warning 2020-02-05 21:22:47 +00:00
wext-priv.c
wext-proc.c proc: introduce proc_create_net{,_data} 2018-05-16 07:24:30 +02:00
wext-sme.c cfg80211: wext: avoid copying malformed SSIDs 2019-10-04 14:04:08 +02:00
wext-spy.c