Laura Abbott 4a2fbab9e8 rtlwifi: Fix potential overflow on P2P code ...

commit 8c55dedb79 upstream.

Nicolas Waisman noticed that even though noa_len is checked for
a compatible length it's still possible to overrun the buffers
of p2pinfo since there's no check on the upper bound of noa_num.
Bound noa_num against P2P_MAX_NOA_NUM.

Reported-by: Nicolas Waisman <nico@semmle.com>
Signed-off-by: Laura Abbott <labbott@redhat.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-11-06 12:18:22 +01:00

..

admtek

adm80211: add checks for dma mapping errors

2017-11-30 08:39:13 +00:00

ath

ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()

2019-11-06 12:18:14 +01:00

atmel

at76c50x-usb: Don't register led_trigger if usb_register_driver failed

2019-05-31 06:48:13 -07:00

broadcom

brcmfmac: add subtype check for event handling in data path

2019-06-11 12:22:44 +02:00

cisco

wireless: airo: rename 'register' variable

2016-06-29 18:56:20 +03:00

intel

iwlwifi: don't unmap as page memory that was mapped as single

2019-08-25 10:51:39 +02:00

intersil

p54usb: Fix race between disconnect and firmware loading

2019-07-21 09:06:01 +02:00

marvell

libertas: Add missing sentinel at end of if_usb.c fw_table

2019-10-05 12:30:27 +02:00

mediatek

mt7601u: fix possible memory leak when the device is disconnected

2019-08-04 09:33:22 +02:00

ralink

rt2x00: do not increment sequence number while re-transmitting

2019-04-27 09:34:45 +02:00

realtek

rtlwifi: Fix potential overflow on P2P code

2019-11-06 12:18:22 +01:00

rsi

rsi: improve kernel thread handling to fix kernel panic

2019-04-20 09:07:51 +02:00

st

net: cw1200: fix a NULL pointer dereference

2019-05-31 06:48:16 -07:00

ti

wlcore: Fix memory leak in case wl12xx_fetch_firmware failure

2019-04-05 22:29:15 +02:00

zydas

zd1211rw: fix NULL-deref at probe

2018-03-22 09:17:41 +01:00

Kconfig

mac80211_hwsim: move Kconfig entry for sorting alphabetically

2015-11-18 15:23:36 +02:00

mac80211_hwsim.c

mac80211_hwsim: propagate genlmsg_reply return code

2019-03-23 13:19:44 +01:00

mac80211_hwsim.h

drivers/wireless: use nla_put_u64_64bit()

2016-04-26 12:00:48 -04:00

Makefile

ath: unify Kconfig with other vendors

2015-11-18 14:28:31 +02:00

ray_cs.c

ray_cs: Avoid reading past end of buffer

2018-04-13 19:48:03 +02:00

ray_cs.h

ray_cs: Add include guards

2014-08-28 14:41:56 -04:00

rayctl.h

ray_cs: Add include guards

2014-08-28 14:41:56 -04:00

rndis_wlan.c

rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication()

2018-10-03 17:01:46 -07:00

wl3501_cs.c

wl3501_cs: Add spinlock to wl3501_reset

2016-09-03 13:01:18 +03:00

wl3501.h

…