Anant Thazhemadam 3dc289f8f1 net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() ... In nl80211_parse_key(), key.idx is first initialized as -1. If this value of key.idx remains unmodified and gets returned, and nl80211_key_allowed() also returns 0, then rdev_del_key() gets called with key.idx = -1. This causes an out-of-bounds array access. Handle this issue by checking if the value of key.idx after nl80211_parse_key() is called and return -EINVAL if key.idx < 0. Cc: stable@vger.kernel.org Reported-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com Tested-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com> Link: https://lore.kernel.org/r/20201007035401.9522-1-anant.thazhemadam@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>		2020-10-08 12:37:25 +02:00
..
certs
.gitignore	.gitignore: add SPDX License Identifier	2020-03-25 11:50:48 +01:00
ap.c
chan.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-09-03 18:50:48 -07:00
core.c	mm, treewide: rename kzfree() to kfree_sensitive()	2020-08-07 11:33:22 -07:00
core.h	cfg80211: fix management registrations deadlock	2020-06-05 09:22:00 +02:00
debugfs.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
debugfs.h
ethtool.c	cfg80211: check wiphy driver existence for drvinfo report	2020-02-07 12:53:26 +01:00
ibss.c	mm, treewide: rename kzfree() to kfree_sensitive()	2020-08-07 11:33:22 -07:00
Kconfig	lib80211: fix unmet direct dependendices config warning when !CRYPTO	2020-09-18 11:37:24 +02:00
lib80211.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
lib80211_crypt_ccmp.c	lib80211: use crypto API ccm(aes) transform for CCMP processing	2019-07-26 13:22:47 +02:00
lib80211_crypt_tkip.c	mm, treewide: rename kzfree() to kfree_sensitive()	2020-08-07 11:33:22 -07:00
lib80211_crypt_wep.c	mm, treewide: rename kzfree() to kfree_sensitive()	2020-08-07 11:33:22 -07:00
Makefile	wireless: Skip directory when generating certificates	2019-05-14 10:27:57 +02:00
mesh.c	cfg80211/mac80211: add mesh_param "mesh_nolearn" to skip path discovery	2020-07-31 09:24:23 +02:00
mlme.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
nl80211.c	net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()	2020-10-08 12:37:25 +02:00
nl80211.h	nl80211: link recursive netlink nested policy	2020-04-30 17:51:41 -07:00
ocb.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
of.c
pmsr.c	nl80211: link recursive netlink nested policy	2020-04-30 17:51:41 -07:00
radiotap.c	docs: networking: convert radiotap-headers.txt to ReST	2020-04-30 12:56:37 -07:00
rdev-ops.h	nl80211: add ability to report TX status for control port TX	2020-05-27 10:02:04 +02:00
reg.c	cfg80211: regulatory: reject invalid hints	2020-08-27 10:53:14 +02:00
reg.h	net: Fix various misspellings of "connect"	2019-10-28 13:41:59 -07:00
scan.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
sme.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
sysfs.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 432	2019-06-05 17:37:16 +02:00
sysfs.h
trace.c
trace.h	cfg80211/mac80211: add mesh_param "mesh_nolearn" to skip path discovery	2020-07-31 09:24:23 +02:00
util.c	cfg80211: fix 6 GHz channel conversion	2020-09-18 11:43:46 +02:00
wext-compat.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
wext-compat.h	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00
wext-core.c	wireless: wext: avoid gcc -O3 warning	2020-01-15 09:52:20 +01:00
wext-priv.c
wext-proc.c
wext-sme.c	mm, treewide: rename kzfree() to kfree_sensitive()	2020-08-07 11:33:22 -07:00
wext-spy.c