No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Johannes Berg 50149e0866 mac80211: fix use-after-free in CCMP/GCMP RX
commit 94513069eb549737bcfc3d988d6ed4da948a2de8 upstream.

When PN checking is done in mac80211, for fragmentation we need
to copy the PN to the RX struct so we can later use it to do a
comparison, since commit bf30ca922a0c ("mac80211: check defrag
PN against current frame").

Unfortunately, in that commit I used the 'hdr' variable without
it being necessarily valid, so use-after-free could occur if it
was necessary to reallocate (parts of) the frame.

Fix this by reloading the variable after the code that results
in the reallocations, if any.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.

Cc: stable@vger.kernel.org
Fixes: bf30ca922a0c ("mac80211: check defrag PN against current frame")
Link: https://lore.kernel.org/r/20210927115838.12b9ac6bb233.I1d066acd5408a662c3b6e828122cd314fcb28cdb@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-10-06 15:42:31 +02:00
arch arm64: dts: marvell: armada-37xx: Extend PCIe MEM space 2021-09-30 10:09:26 +02:00
block blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd 2021-09-30 10:09:25 +02:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-15 09:47:29 +02:00
crypto crypto: shash - avoid comparing pointers to exported functions under CFI 2021-07-14 16:53:13 +02:00
Documentation dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation 2021-09-22 12:26:43 +02:00
drivers scsi: ufs: Fix illegal offset in UPIU event trace 2021-10-06 15:42:31 +02:00
fs fs-verity: fix signed integer overflow with i_size near S64_MAX 2021-10-06 15:42:30 +02:00
include compiler.h: Introduce absolute_pointer macro 2021-09-30 10:09:25 +02:00
init kbuild: add CONFIG_LD_IS_LLD 2021-06-30 08:47:44 -04:00
ipc
kernel cpufreq: schedutil: Use kobject release() method to free sugov_tunables 2021-10-06 15:42:29 +02:00
lib Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH 2021-09-26 14:07:10 +02:00
LICENSES
mm mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range() 2021-09-22 12:26:43 +02:00
net mac80211: fix use-after-free in CCMP/GCMP RX 2021-10-06 15:42:31 +02:00
samples samples: bpf: Fix tracex7 error raised on the missing argument 2021-09-22 12:26:30 +02:00
scripts kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y 2021-09-22 12:26:26 +02:00
security apparmor: remove duplicate macro list_entry_is_head() 2021-09-26 14:07:06 +02:00
sound ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B 2021-09-22 12:26:35 +02:00
tools perf unwind: Do not overwrite FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64} 2021-09-22 12:26:45 +02:00
usr
virt KVM: remember position in kvm->vcpus array 2021-09-26 14:07:05 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.150 2021-09-30 10:09:26 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.