Anant Thazhemadam 785ef2d0c5 net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() ...

commit 3dc289f8f139997f4e9d3cfccf8738f20d23e47b upstream.

In nl80211_parse_key(), key.idx is first initialized as -1.
If this value of key.idx remains unmodified and gets returned, and
nl80211_key_allowed() also returns 0, then rdev_del_key() gets called
with key.idx = -1.
This causes an out-of-bounds array access.

Handle this issue by checking if the value of key.idx after
nl80211_parse_key() is called and return -EINVAL if key.idx < 0.

Cc: stable@vger.kernel.org
Reported-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Tested-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201007035401.9522-1-anant.thazhemadam@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2020-10-14 09:46:22 +02:00

..

.gitignore

…

ap.c

…

chan.c

cfg80211: use RTNL locked reg_can_beacon for IR-relaxation

2015-07-17 15:02:02 +02:00

core.c

cfg80211: fix memory leak of wiphy device name

2019-07-10 09:56:34 +02:00

core.h

cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts

2017-01-09 08:07:42 +01:00

db.txt

…

debugfs.c

…

debugfs.h

…

ethtool.c

cfg80211: check wiphy driver existence for drvinfo report

2020-03-11 07:51:12 +01:00

genregdb.awk

…

ibss.c

Merge tag 'mac80211-next-for-davem-2015-03-30' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

2015-03-31 16:39:04 -04:00

Kconfig

cfg80211: reg: make CRDA support optional

2015-10-16 09:15:39 +02:00

lib80211_crypt_ccmp.c

…

lib80211_crypt_tkip.c

…

lib80211_crypt_wep.c

…

lib80211.c

…

Makefile

…

mesh.c

…

mlme.c

cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts

2017-01-09 08:07:42 +01:00

nl80211.c

net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()

2020-10-14 09:46:22 +02:00

nl80211.h

…

ocb.c

…

radiotap.c

…

rdev-ops.h

cfg80211: check for set_wiphy_params

2020-01-23 08:18:40 +01:00

reg.c

cfg80211: regulatory: reject invalid hints

2020-09-12 11:45:32 +02:00

reg.h

cfg80211: Stop calling crda if it is not responsive

2015-04-01 11:22:38 +02:00

regdb.h

…

scan.c

cfg80211: limit scan results cache size

2016-12-02 09:09:01 +01:00

sme.c

cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts

2017-01-09 08:07:42 +01:00

sysfs.c

cfg80211: Switch to PM ops

2015-05-20 15:00:12 +02:00

sysfs.h

…

trace.c

…

trace.h

nl80211: allow BSS data to include CLOCK_BOOTTIME timestamp

2015-10-13 10:32:17 +02:00

util.c

cfg80211/mac80211: make ieee80211_send_layer2_update a public function

2020-01-23 08:18:35 +01:00

wext-compat.c

cfg80211: initialize on-stack chandefs

2019-10-17 13:40:54 -07:00

wext-compat.h

cfg80211-wext: export symbols only when needed

2015-02-28 21:31:09 +01:00

wext-core.c

wireless: wext: avoid gcc -O3 warning

2020-02-05 13:03:42 +00:00

wext-priv.c

…

wext-proc.c

…

wext-sme.c

cfg80211: wext: avoid copying malformed SSIDs

2019-10-29 09:13:26 +01:00

wext-spy.c

…