Srinivas Dasari 2d3c10e215 cfg80211: Check if PMKID attribute is of expected size ...

commit 9361df14d1 upstream.

nla policy checks for only maximum length of the attribute data
when the attribute type is NLA_BINARY. If userspace sends less
data than specified, the wireless drivers may access illegal
memory. When type is NLA_UNSPEC, nla policy check ensures that
userspace sends minimum specified length number of bytes.

Remove type assignment to NLA_BINARY from nla_policy of
NL80211_ATTR_PMKID to make this NLA_UNSPEC and to make sure minimum
WLAN_PMKID_LEN bytes are received from userspace with
NL80211_ATTR_PMKID.

Fixes: 67fbb16be6 ("nl80211: PMKSA caching support")
Signed-off-by: Srinivas Dasari <dasaris@qti.qualcomm.com>
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-07-21 07:44:56 +02:00

..

.gitignore

wireless: support internal statically compiled regulatory database

2009-12-21 18:56:10 -05:00

ap.c

cfg80211: export interface stopping function

2014-05-06 15:16:34 +02:00

chan.c

cfg80211: use RTNL locked reg_can_beacon for IR-relaxation

2015-07-17 15:02:02 +02:00

core.c

cfg80211/wext: fix message ordering

2016-03-16 08:42:59 -07:00

core.h

cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts

2017-01-09 08:07:42 +01:00

db.txt

wireless: support internal statically compiled regulatory database

2009-12-21 18:56:10 -05:00

debugfs.c

mac80211: fix some snprintf misuses

2013-10-01 12:16:51 +02:00

debugfs.h

cfg80211/mac80211: use debugfs_remove_recursive

2009-10-30 16:49:18 -04:00

ethtool.c

cfg80211: make ethtool the driver's responsibility

2014-06-23 11:05:33 +02:00

genregdb.awk

wireless: fixup genregdb.awk for remove of antenna gain from wireless-regd

2014-07-21 12:24:20 +02:00

ibss.c

Merge tag 'mac80211-next-for-davem-2015-03-30' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

2015-03-31 16:39:04 -04:00

Kconfig

cfg80211: reg: make CRDA support optional

2015-10-16 09:15:39 +02:00

lib80211_crypt_ccmp.c

hostap: Don't use create_proc_read_entry()

2013-04-29 15:41:56 -04:00

lib80211_crypt_tkip.c

hostap: Don't use create_proc_read_entry()

2013-04-29 15:41:56 -04:00

lib80211_crypt_wep.c

hostap: Don't use create_proc_read_entry()

2013-04-29 15:41:56 -04:00

lib80211.c

lib80211: remove unused print_ssid()

2014-10-14 02:18:27 +02:00

Makefile

cfg80211: 802.11p OCB mode handling

2014-11-04 13:18:17 +01:00

mesh.c

cfg80211: export interface stopping function

2014-05-06 15:16:34 +02:00

mlme.c

cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts

2017-01-09 08:07:42 +01:00

nl80211.c

cfg80211: Check if PMKID attribute is of expected size

2017-07-21 07:44:56 +02:00

nl80211.h

cfg80211: allow wiphy specific regdomain management

2014-12-17 11:49:55 +01:00

ocb.c

cfg80211: 802.11p OCB mode handling

2014-11-04 13:18:17 +01:00

radiotap.c

radiotap: fix bitmap-end-finding buffer overrun

2013-12-16 12:06:43 +01:00

rdev-ops.h

cfg80211: allow mgmt_frame_register callback to sleep

2015-07-17 15:38:26 +02:00

reg.c

nl80211: fix a few memory leaks in reg.c

2015-12-15 13:08:02 +01:00

reg.h

cfg80211: Stop calling crda if it is not responsive

2015-04-01 11:22:38 +02:00

regdb.h

cfg80211: relicense reg.c reg.h and genregdb.awk to ISC

2012-01-04 14:30:41 -05:00

scan.c

cfg80211: limit scan results cache size

2016-12-02 09:09:01 +01:00

sme.c

cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts

2017-01-09 08:07:42 +01:00

sysfs.c

cfg80211: Switch to PM ops

2015-05-20 15:00:12 +02:00

sysfs.h

net: misc: Remove extern from function prototypes

2013-10-19 19:12:11 -04:00

trace.c

cfg80211: add tracing to rdev-ops

2012-10-18 10:53:37 +02:00

trace.h

nl80211: allow BSS data to include CLOCK_BOOTTIME timestamp

2015-10-13 10:32:17 +02:00

util.c

cfg80211: ignore netif running state when changing iftype

2015-05-29 13:05:40 +02:00

wext-compat.c

cfg80211: wext: clear sinfo struct before calling driver

2015-06-09 13:54:58 -07:00

wext-compat.h

cfg80211-wext: export symbols only when needed

2015-02-28 21:31:09 +01:00

wext-core.c

Revert "wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel"

2016-09-24 10:07:41 +02:00

wext-priv.c

wext: fix potential private ioctl memory content leak

2010-09-20 13:41:40 -04:00

wext-proc.c

net: proc: change proc_net_remove to remove_proc_entry

2013-02-18 14:53:08 -05:00

wext-sme.c

wireless: Use eth_<foo>_addr instead of memset

2015-03-03 17:01:38 -05:00

wext-spy.c

wireless: Convert compare_ether_addr to ether_addr_equal

2012-05-09 20:49:19 -04:00