Files
kernel_google_wahoo/net
Anant Thazhemadam 785ef2d0c5 net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()
commit 3dc289f8f139997f4e9d3cfccf8738f20d23e47b upstream.

In nl80211_parse_key(), key.idx is first initialized as -1.
If this value of key.idx remains unmodified and gets returned, and
nl80211_key_allowed() also returns 0, then rdev_del_key() gets called
with key.idx = -1.
This causes an out-of-bounds array access.

Handle this issue by checking if the value of key.idx after
nl80211_parse_key() is called and return -EINVAL if key.idx < 0.

Cc: stable@vger.kernel.org
Reported-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Tested-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201007035401.9522-1-anant.thazhemadam@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-14 09:46:22 +02:00
..
2020-08-21 10:52:56 +02:00
2019-12-05 15:27:07 +01:00
2020-04-02 19:02:34 +02:00
2015-10-07 04:27:43 -07:00
2019-06-22 08:18:25 +02:00
2020-05-20 08:11:52 +02:00
2020-07-22 09:10:03 +02:00
2019-03-23 08:44:34 +01:00
2018-02-25 11:03:37 +01:00