Johannes Berg
bd02cd2549
radiotap: fix bitmap-end-finding buffer overrun
...
Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.
Cc: stable@vger.kernel.org
Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-12-16 12:06:43 +01:00
..
9p
Nothing really exciting: some groundwork for changing virtio endian, and
2013-11-15 13:28:47 +09:00
802
8021q
Merge branch 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2013-11-14 16:30:30 +09:00
appletalk
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
atm
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
ax25
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
batman-adv
bluetooth
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
2013-11-21 10:26:17 -05:00
bridge
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
2013-11-21 12:44:15 -05:00
caif
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
can
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2013-11-15 16:47:22 -08:00
ceph
core
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
dcb
dccp
ipv4: introduce new IP_MTU_DISCOVER mode IP_PMTUDISC_INTERFACE
2013-11-05 21:52:27 -05:00
decnet
dns_resolver
dsa
ethernet
hsr
genetlink: make multicast groups const, prevent abuse
2013-11-19 16:39:06 -05:00
ieee802154
genetlink: make multicast groups const, prevent abuse
2013-11-19 16:39:06 -05:00
ipv4
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
2013-11-21 12:44:15 -05:00
ipv6
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
2013-11-21 12:44:15 -05:00
ipx
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
irda
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
iucv
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
key
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
l2tp
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
lapb
llc
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
mac80211
mac80211: check csa wiphy flag in ibss before switching
2013-12-02 11:54:13 +01:00
mac802154
6lowpan: set and use mac_len for mac header length
2013-10-30 17:18:46 -04:00
mpls
netfilter
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
2013-11-21 12:44:15 -05:00
netlabel
genetlink: only pass array to genl_register_family_with_ops()
2013-11-19 16:39:05 -05:00
netlink
genetlink: fix genlmsg_multicast() bug
2013-11-21 13:09:43 -05:00
netrom
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
nfc
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
openvswitch
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2013-11-19 15:50:47 -08:00
packet
packet: fix use after free race in send path when dev is released
2013-11-21 13:09:43 -05:00
phonet
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2013-11-19 15:50:47 -08:00
rds
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
rfkill
net: rfkill: gpio: add ACPI support
2013-10-28 15:05:25 +01:00
rose
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
rxrpc
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
sched
pkt_sched: fq: fix pacing for small frames
2013-11-15 21:01:52 -05:00
sctp
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2013-11-19 15:50:47 -08:00
sunrpc
NFS client bugfixes:
2013-11-16 13:14:56 -08:00
tipc
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
unix
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
vmw_vsock
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
wimax
wimax: remove dead code
2013-11-21 13:09:42 -05:00
wireless
radiotap: fix bitmap-end-finding buffer overrun
2013-12-16 12:06:43 +01:00
x25
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
xfrm
net: move pskb_put() to core code
2013-11-07 19:28:58 -05:00
compat.c
net: rework recvmsg handler msg_name and msg_namelen logic
2013-11-20 21:52:30 -05:00
Kconfig
net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)
2013-11-03 23:20:14 -05:00
Makefile
net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)
2013-11-03 23:20:14 -05:00
nonet.c
socket.c
net: add BUG_ON if kernel advertises msg_namelen > sizeof(struct sockaddr_storage)
2013-11-20 21:52:30 -05:00
sysctl_net.c