linux-stable/net/wireless
Johannes Berg 16da1e1dac wifi: cfg80211: check A-MSDU format more carefully
[ Upstream commit 9ad7974856 ]

If it looks like there's another subframe in the A-MSDU
but the header isn't fully there, we can end up reading
data out of bounds, only to discard later. Make this a
bit more careful and check if the subframe header can
even be present.

Reported-by: syzbot+d050d437fe47d479d210@syzkaller.appspotmail.com
Link: https://msgid.link/20240226203405.a731e2c95e38.I82ce7d8c0cc8970ce29d0a39fdc07f1ffc425be4@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-04-13 13:10:01 +02:00
..
certs wifi: cfg80211: fix certs build to not depend on file order 2023-12-14 09:11:51 +01:00
tests wifi: cfg80211: add RNR with reporting AP information 2024-03-26 18:16:33 -04:00
.gitignore
Kconfig wifi: cfg80211/mac80211: remove dependency on non-existing option 2024-01-18 14:50:01 +01:00
Makefile wifi: cfg80211: sort certificates in build 2023-12-14 12:04:21 +01:00
ap.c wifi: cfg80211: remove wdev mutex 2023-09-11 11:27:23 +02:00
chan.c wifi: cfg80211: reg: Support P2P operation on DFS channels 2023-12-21 20:35:14 +01:00
core.c wifi: cfg80211: fix wiphy delayed work queueing 2024-01-26 10:43:32 +01:00
core.h wifi: cfg80211: tests: add some scanning related tests 2024-01-03 15:35:22 +01:00
debugfs.c wifi: cfg80211: add locked debugfs wrappers 2023-11-27 11:24:58 +01:00
debugfs.h
ethtool.c wifi: cfg80211: use strscpy to replace strlcpy 2022-07-15 11:43:12 +02:00
ibss.c wifi: cfg80211: remove wdev mutex 2023-09-11 11:27:23 +02:00
lib80211.c
lib80211_crypt_ccmp.c wifi: use struct_group to copy addresses 2022-09-03 16:40:06 +02:00
lib80211_crypt_tkip.c wifi: lib80211: remove unused variables iv32 and iv16 2023-09-13 12:33:58 +02:00
lib80211_crypt_wep.c
mesh.c wifi: cfg80211: remove scan_width support 2023-09-13 11:10:50 +02:00
mlme.c wifi: cfg80211: make RX assoc data const 2023-12-06 11:50:28 +01:00
nl80211.c wifi: nl80211: reject iftype change with mesh ID change 2024-02-15 11:00:37 +01:00
nl80211.h wifi: cfg80211: make RX assoc data const 2023-12-06 11:50:28 +01:00
ocb.c wifi: cfg80211: remove wdev mutex 2023-09-11 11:27:23 +02:00
of.c
pmsr.c wifi: cfg80211: remove wdev mutex 2023-09-11 11:27:23 +02:00
radiotap.c mac80211: Use flex-array for radiotap header bitmap 2021-08-13 09:58:25 +02:00
rdev-ops.h wifi: cfg80211: Replace ENOTSUPP with EOPNOTSUPP 2023-12-12 10:37:01 +01:00
reg.c wifi: cfg80211: handle UHB AP and STA power type 2023-12-21 20:35:14 +01:00
reg.h wifi: cfg80211: Schedule regulatory check on BSS STA channel change 2023-12-21 20:35:14 +01:00
scan.c wifi: cfg80211: set correct param change count in ML element 2024-03-26 18:16:46 -04:00
sme.c wifi: cfg80211: Schedule regulatory check on BSS STA channel change 2023-12-21 20:35:14 +01:00
sysfs.c wifi: cfg80211: add flush functions for wiphy work 2023-09-11 11:27:19 +02:00
sysfs.h
trace.c
trace.h wifi: cfg80211: Add support for setting TID to link mapping 2023-12-12 10:37:00 +01:00
util.c wifi: cfg80211: check A-MSDU format more carefully 2024-04-13 13:10:01 +02:00
wext-compat.c wifi: cfg80211: wext: convert return value to kernel-doc 2023-10-23 11:45:17 +02:00
wext-compat.h wifi: cfg80211: Avoid clashing function prototypes 2022-11-16 11:31:47 +02:00
wext-core.c wifi: cfg80211: add a flag to disable wireless extensions 2024-04-03 15:32:38 +02:00
wext-priv.c
wext-proc.c
wext-sme.c wifi: cfg80211: remove wdev mutex 2023-09-11 11:27:23 +02:00
wext-spy.c wireless: wext-spy: Fix out-of-bounds warning 2021-06-23 10:57:17 +02:00