Johannes Berg de124365a7 wifi: mac80211: fix MBSSID parsing use-after-free ... commit ff05d4b45d When we parse a multi-BSSID element, we might point some element pointers into the allocated nontransmitted_profile. However, we free this before returning, causing UAF when the relevant pointers in the parsed elements are accessed. Fix this by not allocating the scratch buffer separately but as part of the returned structure instead, that way, there are no lifetime issues with it. The scratch buffer introduction as part of the returned data here is taken from MLO feature work done by Ilan. This fixes CVE-2022-42719. Fixes: 5023b14cf4 ("mac80211: support profile split between elements") Co-developed-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Cc: Felix Fietkau <nbd@nbd.name> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-10-15 07:59:05 +02:00
..
6lowpan	…
9p	net/9p: Initialize the iounit field during fid creation	2022-08-17 14:24:23 +02:00
802	…
8021q	net: use eth_hw_addr_set() instead of ether_addr_copy()	2022-08-31 17:16:37 +02:00
appletalk	…
atm	…
ax25	net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg	2022-06-22 14:22:01 +02:00
batman-adv	batman-adv: Use netif_rx_any_context() any.	2022-07-29 17:25:07 +02:00
bluetooth	Bluetooth: L2CAP: Fix build errors in some archs	2022-09-05 10:30:06 +02:00
bpf	bpf: Don't redirect packets with invalid pkt_len	2022-09-05 10:30:07 +02:00
bpfilter	…
bridge	netfilter: ebtables: fix memory leak when blob is malformed	2022-09-28 11:11:52 +02:00
caif	…
can	can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once()	2022-08-25 11:40:46 +02:00
ceph	libceph: fix potential use-after-free on linger ping and resends	2022-05-25 09:57:28 +02:00
core	net: core: fix flow symmetric hash	2022-09-28 11:11:47 +02:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-08 19:12:52 +01:00
dccp	dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock	2022-08-17 14:23:37 +02:00
decnet	net: Fix data-races around sysctl_[rw]mem(_offset)?.	2022-08-03 12:03:51 +02:00
dns_resolver	…
dsa	net: dsa: hellcreek: Print warning only once	2022-09-20 12:39:45 +02:00
ethernet	…
ethtool	ethtool: Fix get module eeprom fallback	2022-06-29 09:03:23 +02:00
hsr	net: use eth_hw_addr_set() instead of ether_addr_copy()	2022-08-31 17:16:37 +02:00
ieee802154	net/ieee802154: fix uninit value bug in dgram_sendmsg	2022-10-12 09:53:27 +02:00
ife	…
ipv4	net: Find dst with sk's xfrm policy not ctl_sk	2022-09-23 14:15:51 +02:00
ipv6	net: Find dst with sk's xfrm policy not ctl_sk	2022-09-23 14:15:51 +02:00
iucv	…
kcm	kcm: fix strp_init() order and cleanup	2022-09-08 12:28:03 +02:00
key	af_key: Do not call xfrm_probe_algs in parallel	2022-08-31 17:16:36 +02:00
l2tp	ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg	2022-06-22 14:21:58 +02:00
l3mdev	l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu	2022-04-27 14:38:53 +02:00
lapb	…
llc	llc: only change llc->dev when bind() succeeds	2022-03-28 09:58:46 +02:00
mac80211	wifi: mac80211: fix MBSSID parsing use-after-free	2022-10-15 07:59:05 +02:00
mac802154	net: mac802154: Fix a condition in the receive path	2022-09-08 12:28:07 +02:00
mctp	mctp: Fix check for dev_hard_header() result	2022-04-13 20:59:16 +02:00
mpls	net: Use u64_stats_fetch_begin_irq() for stats fetch.	2022-09-08 12:28:07 +02:00
mptcp	mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb	2022-08-31 17:16:50 +02:00
ncsi	net/ncsi: check for error return from call to nla_put_u32	2022-01-05 12:42:37 +01:00
netfilter	netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain()	2022-09-28 11:11:51 +02:00
netlabel	netlabel: fix out-of-bounds memory accesses	2022-04-13 20:59:10 +02:00
netlink	net: genl: fix error path memory leak in policy dumping	2022-08-25 11:40:25 +02:00
netrom	netrom: fix api breakage in nr_setsockopt()	2022-01-27 11:04:00 +01:00
nfc	NFC: NULL out the dev->rfkill to prevent UAF	2022-06-09 10:22:46 +02:00
nsh	…
openvswitch	openvswitch: fix memory leak at failed datapath creation	2022-09-08 12:28:02 +02:00
packet	net/af_packet: check len when min_header_len equals to 0	2022-09-05 10:30:12 +02:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 15:35:16 +01:00
psample	…
qrtr	net: qrtr: start MHI channel after endpoit creation	2022-08-25 11:40:29 +02:00
rds	rds: add missing barrier to release_refill	2022-08-25 11:39:54 +02:00
rfkill	rfkill: make new event layout opt-in	2022-04-08 14:23:00 +02:00
rose	rose: check NULL rose_loopback_neigh->loopback	2022-08-31 17:16:38 +02:00
rxrpc	rxrpc: Fix calc of resend age	2022-09-23 14:15:50 +02:00
sched	net: sched: act_ct: fix possible refcount leak in tcf_ct_init()	2022-10-05 10:39:42 +02:00
sctp	sctp: leave the err path free in sctp_stream_init to sctp_stream_free	2022-08-03 12:03:54 +02:00
smc	net/smc: Stop the CLC flow if no link to map buffers on	2022-09-28 11:11:53 +02:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-18 19:17:11 +01:00
sunrpc	SUNRPC: RPC level errors should set task->tk_rpc_status	2022-08-31 17:16:37 +02:00
switchdev	…
tipc	tipc: fix shift wrapping bug in map_get()	2022-09-15 11:30:05 +02:00
tls	net/tls: Remove the context from the list in tls_device_down	2022-08-03 12:03:47 +02:00
unix	af_unix: Fix a data-race in unix_dgram_peer_wake_me().	2022-06-14 18:36:17 +02:00
vmw_vsock	vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout()	2022-08-25 11:40:11 +02:00
wireless	wifi: cfg80211: update hidden BSSes to avoid WARN_ON	2022-10-15 07:59:03 +02:00
x25	net/x25: Fix null-ptr-deref caused by x25_disconnect	2022-04-08 14:23:53 +02:00
xdp	xsk: Inherit need_wakeup flag for shared sockets	2022-10-12 09:53:26 +02:00
xfrm	net: Fix data-races around netdev_max_backlog.	2022-08-31 17:16:42 +02:00
Kconfig	…
Makefile	…
compat.c	…
devres.c	…
socket.c	net: Fix a data-race around sysctl_somaxconn.	2022-08-31 17:16:45 +02:00
sysctl_net.c	…