No description
Find a file
Johannes Berg bfe2987345 wifi: cfg80211: fix BSS refcounting bugs
commit 0b7808818c upstream.

There are multiple refcounting bugs related to multi-BSSID:
 - In bss_ref_get(), if the BSS has a hidden_beacon_bss, then
   the bss pointer is overwritten before checking for the
   transmitted BSS, which is clearly wrong. Fix this by using
   the bss_from_pub() macro.

 - In cfg80211_bss_update() we copy the transmitted_bss pointer
   from tmp into new, but then if we release new, we'll unref
   it erroneously. We already set the pointer and ref it, but
   need to NULL it since it was copied from the tmp data.

 - In cfg80211_inform_single_bss_data(), if adding to the non-
   transmitted list fails, we unlink the BSS and yet still we
   return it, but this results in returning an entry without
   a reference. We shouldn't return it anyway if it was broken
   enough to not get added there.

This fixes CVE-2022-42720.

Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: a3584f56de ("cfg80211: Properly track transmitting and non-transmitting BSS")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-15 07:59:03 +02:00
arch Revert "powerpc/rtas: Implement reentrant rtas call" 2022-10-15 07:59:02 +02:00
block block: blk_queue_enter() / __bio_queue_enter() must return -EAGAIN for nowait 2022-09-23 14:15:48 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:22:01 +02:00
crypto KEYS: asymmetric: enforce SM2 signature use pkey algo 2022-08-17 14:24:28 +02:00
Documentation ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer 2022-10-12 09:53:27 +02:00
drivers random: use expired timer rather than wq for mixing fast pool 2022-10-15 07:59:02 +02:00
fs ceph: don't truncate file in atomic_open 2022-10-15 07:59:01 +02:00
include scsi: stex: Properly zero out the passthrough command structure 2022-10-15 07:59:01 +02:00
init stack: Declare {randomize_,}kstack_offset to fix Sparse warnings 2022-08-17 14:23:10 +02:00
ipc ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() 2022-06-09 10:23:10 +02:00
kernel swiotlb: max mapping size takes min align mask into account 2022-10-05 10:39:40 +02:00
lib crypto: lib - remove unneeded selection of XOR_BLOCKS 2022-09-05 10:30:03 +02:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm mm/huge_memory: use pfn_to_online_page() in split_huge_pages_all() 2022-10-12 09:53:28 +02:00
net wifi: cfg80211: fix BSS refcounting bugs 2022-10-15 07:59:03 +02:00
samples samples/landlock: Format with clang-format 2022-06-09 10:23:23 +02:00
scripts Makefile.extrawarn: Move -Wcast-function-type-strict to W=1 2022-10-12 09:53:26 +02:00
security efi: Correct Macmini DMI match in uefi cert quirk 2022-10-15 07:59:01 +02:00
sound ALSA: hda: Fix position reporting on Poulsbo 2022-10-15 07:59:01 +02:00
tools perf parse-events: Identify broken modifiers 2022-10-12 09:53:28 +02:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2022-02-01 17:27:15 +01:00
virt KVM: SEV: add cache flush to solve SEV cache incoherency issues 2022-09-23 14:15:52 +02:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore .gitignore: ignore only top-level modules.builtin 2021-05-02 00:43:35 +09:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS Input: goodix - add a goodix.h header file 2022-07-12 16:34:51 +02:00
Makefile Linux 5.15.73 2022-10-12 09:53:28 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.