Johannes Berg
0cfbb26ee5
wifi: nl80211: reject iftype change with mesh ID change ...
commit f78c1375339a291cba492a70eaf12ec501d28a8e upstream.
It's currently possible to change the mesh ID when the
interface isn't yet in mesh mode, at the same time as
changing it into mesh mode. This leads to an overwrite
of data in the wdev->u union for the interface type it
currently has, causing cfg80211_change_iface() to do
wrong things when switching.
We could probably allow setting an interface to mesh
while setting the mesh ID at the same time by doing a
different order of operations here, but realistically
there's no userspace that's going to do this, so just
disallow changes in iftype when setting mesh ID.
Cc: stable@vger.kernel.org
Fixes: 29cbe68c51syzbot+dd4779978217b1973180@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-03-06 14:36:09 +00:00
net: 9p: avoid freeing uninit memory in p9pdu_vreadf
2024-01-08 11:29:47 +01:00
vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
2024-02-23 08:24:50 +01:00
appletalk: Fix Use-After-Free in atalk_ioctl
2023-12-20 15:41:18 +01:00
atm: Fix Use-After-Free in do_vcc_ioctl
2023-12-20 15:41:15 +01:00
batman-adv: Hold rtnl lock during MTU update via netlink
2023-08-30 16:27:25 +02:00
Bluetooth: Enforce validation on max value of connection interval
2024-03-06 14:36:09 +00:00
net: bridge: clear bridge's private skb space on xmit
2024-03-01 13:13:35 +01:00
can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
2024-02-23 08:25:13 +01:00
libceph: use kernel_connect()
2023-10-25 11:53:19 +02:00
rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
2024-03-06 14:36:09 +00:00
dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
2023-11-20 10:30:15 +01:00
net: sched: ife: fix potential use-after-free
2024-01-08 11:29:44 +01:00
net: ip_tunnel: prevent perpetual headroom growth
2024-03-06 14:36:08 +00:00
ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
2024-03-06 14:36:08 +00:00
net/af_iucv: clean up a try_then_request_module()
2024-02-23 08:25:07 +01:00
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
2023-09-23 11:00:02 +02:00
net: af_key: fix sadb_x_filter validation
2023-08-30 16:27:16 +02:00
l2tp: pass correct message length to ip6_append_data
2024-03-01 13:13:36 +01:00
llc: call sock_orphan() at release time
2024-02-23 08:25:04 +01:00
wifi: mac80211: fix race condition on enabling fast-xmit
2024-03-01 13:13:33 +01:00
net/ncsi: Fix netlink major/minor version numbers
2024-01-25 14:34:25 -08:00
netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
2024-03-06 14:36:09 +00:00
calipso: fix memory leak in netlbl_calipso_add_pass()
2024-01-25 14:34:23 -08:00
netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
2024-03-06 14:36:08 +00:00
netrom: Deny concurrent connect().
2023-09-23 10:59:43 +02:00
nfc: nci: free rx_data_reassembly skb on NCI device cleanup
2024-02-23 08:25:11 +01:00
packet: move from strlcpy with unused retval to strscpy
2024-03-01 13:13:37 +01:00
psample: Require 'CAP_NET_ADMIN' when joining "packets" group
2023-12-13 18:18:17 +01:00
net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
2024-02-23 08:24:50 +01:00
net: rfkill: gpio: set GPIO direction
2024-01-08 11:29:47 +01:00
net/rose: fix races in rose_kill_by_device()
2024-01-08 11:29:44 +01:00
rxrpc: Fix response to PING RESPONSE ACKs to a dead call
2024-02-23 08:25:07 +01:00
net/sched: Retire dsmark qdisc
2024-03-01 13:13:32 +01:00
sctp: update hb timer immediately after users change hb_interval
2023-10-10 21:46:45 +02:00
net/smc: fix illegal rmb_desc access in SMC-D connection dump
2024-02-23 08:24:50 +01:00
SUNRPC: Fix a suspicious RCU usage warning
2024-02-23 08:24:56 +01:00
tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
2024-02-23 08:25:07 +01:00
tls: stop recv() if initial process_rx_list gave us non-DATA
2024-03-01 13:13:37 +01:00
af_unix: fix lockdep positive in sk_diag_dump_icons()
2024-02-23 08:25:05 +01:00
virtio/vsock: fix logic which reduces credit update messages
2024-01-25 14:34:25 -08:00
wifi: nl80211: reject iftype change with mesh ID change
2024-03-06 14:36:09 +00:00
xfrm: interface: use DEV_STATS_INC()
2023-10-25 11:53:21 +02:00
net: Save and restore msg_namelen in sock_sendmsg
2024-01-15 18:25:26 +01:00
0cfbb26ee5