mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-20 17:41:09 +00:00
Code Issues Releases Wiki Activity
linux-stable/net
History
Johannes Berg bfe2987345 wifi: cfg80211: fix BSS refcounting bugs 
commit 0b7808818c upstream.

There are multiple refcounting bugs related to multi-BSSID:
 - In bss_ref_get(), if the BSS has a hidden_beacon_bss, then
   the bss pointer is overwritten before checking for the
   transmitted BSS, which is clearly wrong. Fix this by using
   the bss_from_pub() macro.

 - In cfg80211_bss_update() we copy the transmitted_bss pointer
   from tmp into new, but then if we release new, we'll unref
   it erroneously. We already set the pointer and ref it, but
   need to NULL it since it was copied from the tmp data.

 - In cfg80211_inform_single_bss_data(), if adding to the non-
   transmitted list fails, we unlink the BSS and yet still we
   return it, but this results in returning an entry without
   a reference. We shouldn't return it anyway if it was broken
   enough to not get added there.

This fixes CVE-2022-42720.

Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: a3584f56de ("cfg80211: Properly track transmitting and non-transmitting BSS")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-15 07:59:03 +02:00
..
6lowpan
9p net/9p: Initialize the iounit field during fid creation 2022-08-17 14:24:23 +02:00
802 net: 802: remove dead leftover after ipx driver removal 2021-08-13 16:30:35 -07:00
8021q net: use eth_hw_addr_set() instead of ether_addr_copy() 2022-08-31 17:16:37 +02:00
appletalk
atm
ax25 net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg 2022-06-22 14:22:01 +02:00
batman-adv batman-adv: Use netif_rx_any_context() any. 2022-07-29 17:25:07 +02:00
bluetooth Bluetooth: L2CAP: Fix build errors in some archs 2022-09-05 10:30:06 +02:00
bpf bpf: Don't redirect packets with invalid pkt_len 2022-09-05 10:30:07 +02:00
bpfilter
bridge netfilter: ebtables: fix memory leak when blob is malformed 2022-09-28 11:11:52 +02:00
caif net-caif: avoid user-triggerable WARN_ON(1) 2021-09-14 12:51:15 +01:00
can can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once() 2022-08-25 11:40:46 +02:00
ceph libceph: fix potential use-after-free on linger ping and resends 2022-05-25 09:57:28 +02:00
core net: core: fix flow symmetric hash 2022-09-28 11:11:47 +02:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-08 19:12:52 +01:00
dccp dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock 2022-08-17 14:23:37 +02:00
decnet net: Fix data-races around sysctl_[rw]mem(_offset)?. 2022-08-03 12:03:51 +02:00
dns_resolver
dsa net: dsa: hellcreek: Print warning only once 2022-09-20 12:39:45 +02:00
ethernet move netdev_boot_setup into Space.c 2021-08-03 13:05:26 +01:00
ethtool ethtool: Fix get module eeprom fallback 2022-06-29 09:03:23 +02:00
hsr net: use eth_hw_addr_set() instead of ether_addr_copy() 2022-08-31 17:16:37 +02:00
ieee802154 net/ieee802154: fix uninit value bug in dgram_sendmsg 2022-10-12 09:53:27 +02:00
ife
ipv4 net: Find dst with sk's xfrm policy not ctl_sk 2022-09-23 14:15:51 +02:00
ipv6 net: Find dst with sk's xfrm policy not ctl_sk 2022-09-23 14:15:51 +02:00
iucv net/iucv: Replace deprecated CPU-hotplug functions. 2021-08-09 10:13:32 +01:00
kcm kcm: fix strp_init() order and cleanup 2022-09-08 12:28:03 +02:00
key af_key: Do not call xfrm_probe_algs in parallel 2022-08-31 17:16:36 +02:00
l2tp ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg 2022-06-22 14:21:58 +02:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-27 14:38:53 +02:00
lapb
llc llc: only change llc->dev when bind() succeeds 2022-03-28 09:58:46 +02:00
mac80211 wifi: cfg80211/mac80211: reject bad MBSSID elements 2022-10-15 07:59:02 +02:00
mac802154 net: mac802154: Fix a condition in the receive path 2022-09-08 12:28:07 +02:00
mctp mctp: Fix check for dev_hard_header() result 2022-04-13 20:59:16 +02:00
mpls net: Use u64_stats_fetch_begin_irq() for stats fetch. 2022-09-08 12:28:07 +02:00
mptcp mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb 2022-08-31 17:16:50 +02:00
ncsi net/ncsi: check for error return from call to nla_put_u32 2022-01-05 12:42:37 +01:00
netfilter netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain() 2022-09-28 11:11:51 +02:00
netlabel netlabel: fix out-of-bounds memory accesses 2022-04-13 20:59:10 +02:00
netlink net: genl: fix error path memory leak in policy dumping 2022-08-25 11:40:25 +02:00
netrom netrom: fix api breakage in nr_setsockopt() 2022-01-27 11:04:00 +01:00
nfc NFC: NULL out the dev->rfkill to prevent UAF 2022-06-09 10:22:46 +02:00
nsh
openvswitch openvswitch: fix memory leak at failed datapath creation 2022-09-08 12:28:02 +02:00
packet net/af_packet: check len when min_header_len equals to 0 2022-09-05 10:30:12 +02:00
phonet phonet: refcount leak in pep_sock_accep 2022-01-11 15:35:16 +01:00
psample
qrtr net: qrtr: start MHI channel after endpoit creation 2022-08-25 11:40:29 +02:00
rds rds: add missing barrier to release_refill 2022-08-25 11:39:54 +02:00
rfkill rfkill: make new event layout opt-in 2022-04-08 14:23:00 +02:00
rose rose: check NULL rose_loopback_neigh->loopback 2022-08-31 17:16:38 +02:00
rxrpc rxrpc: Fix calc of resend age 2022-09-23 14:15:50 +02:00
sched net: sched: act_ct: fix possible refcount leak in tcf_ct_init() 2022-10-05 10:39:42 +02:00
sctp sctp: leave the err path free in sctp_stream_init to sctp_stream_free 2022-08-03 12:03:54 +02:00
smc net/smc: Stop the CLC flow if no link to map buffers on 2022-09-28 11:11:53 +02:00
strparser bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-18 19:17:11 +01:00
sunrpc SUNRPC: RPC level errors should set task->tk_rpc_status 2022-08-31 17:16:37 +02:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: fix shift wrapping bug in map_get() 2022-09-15 11:30:05 +02:00
tls net/tls: Remove the context from the list in tls_device_down 2022-08-03 12:03:47 +02:00
unix af_unix: Fix a data-race in unix_dgram_peer_wake_me(). 2022-06-14 18:36:17 +02:00
vmw_vsock vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout() 2022-08-25 11:40:11 +02:00
wireless wifi: cfg80211: fix BSS refcounting bugs 2022-10-15 07:59:03 +02:00
x25 net/x25: Fix null-ptr-deref caused by x25_disconnect 2022-04-08 14:23:53 +02:00
xdp xsk: Inherit need_wakeup flag for shared sockets 2022-10-12 09:53:26 +02:00
xfrm net: Fix data-races around netdev_max_backlog. 2022-08-31 17:16:42 +02:00
compat.c
devres.c
Kconfig mctp: Add MCTP base 2021-07-29 15:06:49 +01:00
Makefile mctp: Add MCTP base 2021-07-29 15:06:49 +01:00
socket.c net: Fix a data-race around sysctl_somaxconn. 2022-08-31 17:16:45 +02:00
sysctl_net.c