You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
commit 3dc289f8f139997f4e9d3cfccf8738f20d23e47b upstream. In nl80211_parse_key(), key.idx is first initialized as -1. If this value of key.idx remains unmodified and gets returned, and nl80211_key_allowed() also returns 0, then rdev_del_key() gets called with key.idx = -1. This causes an out-of-bounds array access. Handle this issue by checking if the value of key.idx after nl80211_parse_key() is called and return -EINVAL if key.idx < 0. Change-Id: Ie00275076bb4ee6a31d0e59b4b0e477ae732327d Cc: stable@vger.kernel.org Reported-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com Tested-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com> Link: https://lore.kernel.org/r/20201007035401.9522-1-anant.thazhemadam@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
3 years ago | |
---|---|---|
.. | ||
9p | 9 years ago | |
802 | 11 years ago | |
8021q | 10 years ago | |
appletalk | 5 years ago | |
atm | 10 years ago | |
ax25 | 5 years ago | |
batman-adv | 8 years ago | |
bluetooth | 3 years ago | |
bridge | 5 years ago | |
caif | 9 years ago | |
can | 5 years ago | |
ceph | 7 years ago | |
core | 4 years ago | |
dcb | 10 years ago | |
dccp | 5 years ago | |
decnet | 5 years ago | |
dns_resolver | 5 years ago | |
dsa | 11 years ago | |
ethernet | 11 years ago | |
ieee802154 | 5 years ago | |
ipc_router | 4 years ago | |
ipv4 | 4 years ago | |
ipv6 | 4 years ago | |
ipx | 5 years ago | |
irda | 5 years ago | |
iucv | 10 years ago | |
key | 4 years ago | |
l2tp | 5 years ago | |
lapb | 11 years ago | |
llc | 5 years ago | |
mac80211 | 5 years ago | |
mac802154 | 11 years ago | |
netfilter | 4 years ago | |
netlabel | 5 years ago | |
netlink | 5 years ago | |
netrom | 5 years ago | |
nfc | 5 years ago | |
openvswitch | 10 years ago | |
packet | 4 years ago | |
phonet | 5 years ago | |
rds | 5 years ago | |
rfkill | 5 years ago | |
rmnet_data | 5 years ago | |
rose | 5 years ago | |
rxrpc | 5 years ago | |
sched | 5 years ago | |
sctp | 5 years ago | |
sunrpc | 5 years ago | |
tipc | 5 years ago | |
unix | 5 years ago | |
vmw_vsock | 5 years ago | |
wimax | 12 years ago | |
wireless | 3 years ago | |
x25 | 5 years ago | |
xfrm | 5 years ago | |
Kconfig | 10 years ago | |
Makefile | 10 years ago | |
activity_stats.c | 11 years ago | |
compat.c | 5 years ago | |
nonet.c | 14 years ago | |
socket.c | 5 years ago | |
sysctl_net.c | 11 years ago |