Alexander Wetzel
6f1959c17d
wifi: cfg80211: Fix use after free for wext ...
commit 015b8cc5e7c4d7bb671f1984d7b7338c310b185b upstream.
Key information in wext.connect is not reset on (re)connect and can hold
data from a previous connection.
Reset key data to avoid that drivers or mac80211 incorrectly detect a
WEP connection request and access the freed or already reused memory.
Additionally optimize cfg80211_sme_connect() and avoid an useless
schedule of conn_work.
Fixes: fffd0934b9stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230124141856.356646-1-alexander@wetzel-home.de
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-11 16:44:03 +01:00
mrp: introduce active flags to prevent UAF when applicant uninit
2023-01-18 11:41:37 +01:00
treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
2023-03-11 16:43:42 +01:00
Bluetooth: L2CAP: Fix potential user-after-free
2023-03-11 16:43:41 +01:00
netfilter: br_netfilter: disable sabotage_in hook after first suppression
2023-02-22 12:50:24 +01:00
net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
2023-03-03 11:41:48 +01:00
can: j1939: do not wait 250 ms if the same addr was already claimed
2023-02-22 12:50:30 +01:00
net: add sock_init_data_uid()
2023-03-11 16:43:40 +01:00
dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
2023-02-22 12:50:40 +01:00
hsr: Avoid double remove of a node.
2023-01-18 11:41:09 +01:00
inet: fix fast path in __inet_hash_connect()
2023-03-11 16:43:55 +01:00
ipv6: Fix tcp socket connection with DSCP.
2023-02-22 12:50:41 +01:00
treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
2023-03-11 16:43:42 +01:00
l2tp: Don't sleep and disable BH under writer-side sk_callback_lock
2023-02-06 07:52:38 +01:00
wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
2023-03-11 16:43:42 +01:00
net: mpls: fix stale pointer if allocation fails during device rename
2023-02-22 12:50:41 +01:00
netfilter: nft_tproxy: restrict to prerouting hook
2023-02-22 12:50:35 +01:00
netlink: annotate data races around sk_state
2023-02-06 07:52:45 +01:00
netrom: Fix use-after-free caused by accept on already connected socket
2023-02-22 12:50:24 +01:00
net: nfc: Fix use-after-free in local_cleanup()
2023-02-06 07:52:37 +01:00
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
2023-02-22 12:50:25 +01:00
net/af_packet: make sure to pull mac header
2023-01-18 11:41:45 +01:00
rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
2023-03-11 16:43:41 +01:00
net/rose: Fix to not accept on connected socket
2023-02-22 12:50:34 +01:00
rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
2023-01-18 11:41:33 +01:00
Revert "net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs"
2023-02-25 11:53:27 +01:00
sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list
2023-02-22 12:50:40 +01:00
xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()
2023-02-22 12:50:29 +01:00
tipc: call tipc_lxc_xmit without holding node_read_lock
2023-01-18 11:42:06 +01:00
net: vmw_vsock: vmci: Check memcpy_from_msg()
2023-01-18 11:41:13 +01:00
wifi: cfg80211: Fix use after free for wext
2023-03-11 16:44:03 +01:00
net/x25: Fix to not accept on connected socket
2023-02-22 12:50:26 +01:00
xfrm: fix bug with DSCP copy to v6 from v4 tunnel
2023-02-22 12:50:31 +01:00
6f1959c17d