Johannes Berg de124365a7 wifi: mac80211: fix MBSSID parsing use-after-free ... commit ff05d4b45d When we parse a multi-BSSID element, we might point some element pointers into the allocated nontransmitted_profile. However, we free this before returning, causing UAF when the relevant pointers in the parsed elements are accessed. Fix this by not allocating the scratch buffer separately but as part of the returned structure instead, that way, there are no lifetime issues with it. The scratch buffer introduction as part of the returned data here is taken from MLO feature work done by Ilan. This fixes CVE-2022-42719. Fixes: 5023b14cf4 ("mac80211: support profile split between elements") Co-developed-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Cc: Felix Fietkau <nbd@nbd.name> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-10-15 07:59:05 +02:00
..
Kconfig	…
Makefile	…
aead_api.c	…
aead_api.h	…
aes_ccm.h	…
aes_cmac.c	…
aes_cmac.h	…
aes_gcm.h	…
aes_gmac.c	…
aes_gmac.h	…
agg-rx.c	mac80211: fix memory leaks with element parsing	2022-10-15 07:59:05 +02:00
agg-tx.c	mac80211: refuse aggregations sessions before authorized	2022-03-19 13:47:48 +01:00
airtime.c	…
cfg.c	mac80211: fix potential double free on mesh join	2022-03-28 09:58:45 +02:00
chan.c	wifi: mac80211: fix use-after-free in chanctx code	2022-06-09 10:23:18 +02:00
debug.h	…
debugfs.c	mac80211: Switch to a virtual time-based airtime scheduler	2021-06-23 18:12:00 +02:00
debugfs.h	…
debugfs_key.c	…
debugfs_key.h	…
debugfs_netdev.c	mac80211: Switch to a virtual time-based airtime scheduler	2021-06-23 18:12:00 +02:00
debugfs_netdev.h	…
debugfs_sta.c	mac80211: Switch to a virtual time-based airtime scheduler	2021-06-23 18:12:00 +02:00
debugfs_sta.h	…
driver-ops.c	…
driver-ops.h	mac80211: mark TX-during-stop for TX in in_reconfig	2021-12-22 09:32:34 +01:00
ethtool.c	…
fils_aead.c	…
fils_aead.h	…
he.c	mac80211: fix NULL ptr dereference during mesh peer connection for non HE devices	2021-06-23 18:06:44 +02:00
ht.c	mac80211: allow SMPS requests only in client mode	2021-06-23 11:29:13 +02:00
ibss.c	mac80211: fix memory leaks with element parsing	2022-10-15 07:59:05 +02:00
ieee80211_i.h	wifi: mac80211: fix MBSSID parsing use-after-free	2022-10-15 07:59:05 +02:00
iface.c	mac80211: fix monitor_sdata RCU/locking assertions	2021-11-25 09:48:34 +01:00
key.c	mac80211: prevent mixed key and fragment cache attacks	2021-05-11 20:12:51 +02:00
key.h	mac80211: prevent mixed key and fragment cache attacks	2021-05-11 20:12:51 +02:00
led.c	mac80211: don't open-code LED manipulations	2021-06-23 11:29:12 +02:00
led.h	mac80211: fix throughput LED trigger	2021-12-08 09:04:38 +01:00
main.c	mac80211: Remove a couple of obsolete TODO	2022-04-08 14:23:28 +02:00
mesh.c	mac80211: always allocate struct ieee802_11_elems	2022-10-15 07:59:05 +02:00
mesh.h	mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh	2022-01-11 15:35:13 +01:00
mesh_hwmp.c	mac80211: always allocate struct ieee802_11_elems	2022-10-15 07:59:05 +02:00
mesh_pathtbl.c	mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh	2022-01-11 15:35:13 +01:00
mesh_plink.c	mac80211: always allocate struct ieee802_11_elems	2022-10-15 07:59:05 +02:00
mesh_ps.c	mac80211: mesh: fix potentially unaligned access	2021-09-23 13:25:09 +02:00
mesh_sync.c	mac80211: mesh: clean up rx_bcn_presp API	2022-10-15 07:59:04 +02:00
michael.c	…
michael.h	…
mlme.c	mac80211: fix memory leaks with element parsing	2022-10-15 07:59:05 +02:00
ocb.c	…
offchannel.c	…
pm.c	…
rate.c	Revert "mac80211: do not use low data rates for data frames with no ack flag"	2021-09-23 12:59:29 +02:00
rate.h	…
rc80211_minstrel_ht.c	mac80211: minstrel_ht: fix where rate stats are stored (fixes debugfs output)	2022-06-09 10:22:31 +02:00
rc80211_minstrel_ht.h	…
rc80211_minstrel_ht_debugfs.c	…
rx.c	wifi: mac80211: fix crash in beacon protection for P2P-device	2022-10-15 07:59:03 +02:00
s1g.c	mac80211: twt: don't use potentially unaligned pointer	2021-11-18 19:16:25 +01:00
scan.c	mac80211: always allocate struct ieee802_11_elems	2022-10-15 07:59:05 +02:00
spectmgmt.c	…
sta_info.c	net: Use u64_stats_fetch_begin_irq() for stats fetch.	2022-09-08 12:28:07 +02:00
sta_info.h	mac80211: fix regression in SSN handling of addba tx	2021-12-22 09:32:34 +01:00
status.c	mac80211: introduce individual TWT support in AP mode	2021-08-24 10:30:43 +02:00
tdls.c	mac80211: always allocate struct ieee802_11_elems	2022-10-15 07:59:05 +02:00
tkip.c	…
tkip.h	…
trace.c	…
trace.h	mac80211: introduce individual TWT support in AP mode	2021-08-24 10:30:43 +02:00
trace_msg.h	…
tx.c	wifi: mac80211: fix regression with non-QoS drivers	2022-10-05 10:39:43 +02:00
util.c	wifi: mac80211: fix MBSSID parsing use-after-free	2022-10-15 07:59:05 +02:00
vht.c	…
wep.c	…
wep.h	…
wme.c	wifi: mac80211: fix queue selection for mesh/OCB interfaces	2022-07-21 21:24:13 +02:00
wme.h	…
wpa.c	mac80211: fix use-after-free in CCMP/GCMP RX	2021-09-27 11:59:49 +02:00
wpa.h	…