Anant Thazhemadam 3dc289f8f1 net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() ... In nl80211_parse_key(), key.idx is first initialized as -1. If this value of key.idx remains unmodified and gets returned, and nl80211_key_allowed() also returns 0, then rdev_del_key() gets called with key.idx = -1. This causes an out-of-bounds array access. Handle this issue by checking if the value of key.idx after nl80211_parse_key() is called and return -EINVAL if key.idx < 0. Cc: stable@vger.kernel.org Reported-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com Tested-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com> Link: https://lore.kernel.org/r/20201007035401.9522-1-anant.thazhemadam@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>		2020-10-08 12:37:25 +02:00
..
certs	…
.gitignore	…
Kconfig	lib80211: fix unmet direct dependendices config warning when !CRYPTO	2020-09-18 11:37:24 +02:00
Makefile	…
ap.c	…
chan.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-09-03 18:50:48 -07:00
core.c	mm, treewide: rename kzfree() to kfree_sensitive()	2020-08-07 11:33:22 -07:00
core.h	cfg80211: fix management registrations deadlock	2020-06-05 09:22:00 +02:00
debugfs.c	…
debugfs.h	…
ethtool.c	…
ibss.c	mm, treewide: rename kzfree() to kfree_sensitive()	2020-08-07 11:33:22 -07:00
lib80211.c	…
lib80211_crypt_ccmp.c	…
lib80211_crypt_tkip.c	mm, treewide: rename kzfree() to kfree_sensitive()	2020-08-07 11:33:22 -07:00
lib80211_crypt_wep.c	mm, treewide: rename kzfree() to kfree_sensitive()	2020-08-07 11:33:22 -07:00
mesh.c	cfg80211/mac80211: add mesh_param "mesh_nolearn" to skip path discovery	2020-07-31 09:24:23 +02:00
mlme.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
nl80211.c	net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()	2020-10-08 12:37:25 +02:00
nl80211.h	nl80211: link recursive netlink nested policy	2020-04-30 17:51:41 -07:00
ocb.c	…
of.c	…
pmsr.c	nl80211: link recursive netlink nested policy	2020-04-30 17:51:41 -07:00
radiotap.c	docs: networking: convert radiotap-headers.txt to ReST	2020-04-30 12:56:37 -07:00
rdev-ops.h	nl80211: add ability to report TX status for control port TX	2020-05-27 10:02:04 +02:00
reg.c	cfg80211: regulatory: reject invalid hints	2020-08-27 10:53:14 +02:00
reg.h	…
scan.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
sme.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
sysfs.c	…
sysfs.h	…
trace.c	…
trace.h	cfg80211/mac80211: add mesh_param "mesh_nolearn" to skip path discovery	2020-07-31 09:24:23 +02:00
util.c	cfg80211: fix 6 GHz channel conversion	2020-09-18 11:43:46 +02:00
wext-compat.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
wext-compat.h	…
wext-core.c	…
wext-priv.c	…
wext-proc.c	…
wext-sme.c	mm, treewide: rename kzfree() to kfree_sensitive()	2020-08-07 11:33:22 -07:00
wext-spy.c	…