kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/net/wireless
History
Veerendranath Jakkam 73dde269a1 wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation 
commit 023c1f2f06 upstream.

Currently during the multi-link element defragmentation process, the
multi-link element length added to the total IEs length when calculating
the length of remaining IEs after the multi-link element in
cfg80211_defrag_mle(). This could lead to out-of-bounds access if the
multi-link element or its corresponding fragment elements are the last
elements in the IEs buffer.

To address this issue, correctly calculate the remaining IEs length by
deducting the multi-link element end offset from total IEs end offset.

Cc: stable@vger.kernel.org
Fixes: 2481b5da9c ("wifi: cfg80211: handle BSS data contained in ML probe responses")
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
Link: https://patch.msgid.link/20250424-fix_mle_defragmentation_oob_access-v1-1-84412a1743fa@quicinc.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-05-18 08:24:04 +02:00
..
certs wifi: cfg80211: fix certs build to not depend on file order 2024-01-01 12:42:39 +00:00
.gitignore .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
ap.c wifi: nl80211: add MLO_LINK_ID to CMD_STOP_AP event 2023-02-14 12:09:17 +01:00
chan.c wifi: cfg80211: move puncturing bitmap validation from mac80211 2023-02-14 12:09:18 +01:00
core.c wifi: cfg80211: cancel wiphy_work before freeing wiphy 2025-03-22 12:50:38 -07:00
core.h Revert "wifi: cfg80211: check wiphy mutex is held for wdev mutex" 2024-09-30 16:25:14 +02:00
debugfs.c wifi: cfg80211: debugfs: fix return type in ht40allow_map_read() 2022-08-25 10:04:46 +02:00
debugfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ethtool.c wifi: cfg80211: use strscpy to replace strlcpy 2022-07-15 11:43:12 +02:00
ibss.c wifi: cfg80211: remove support for static WEP 2023-01-18 17:31:44 +01:00
Kconfig cfg80211: select CONFIG_CRC32 2021-01-05 15:50:36 -08:00
lib80211.c lib80211: Remove unused macro DRV_NAME 2020-09-18 11:53:00 +02:00
lib80211_crypt_ccmp.c wifi: use struct_group to copy addresses 2022-09-03 16:40:06 +02:00
lib80211_crypt_tkip.c mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
lib80211_crypt_wep.c mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
Makefile cfg80211: fix CONFIG_CFG80211_EXTRA_REGDB_KEYDIR typo 2022-03-01 14:10:14 +01:00
mesh.c wifi: cfg80211: do some rework towards MLO link APIs 2022-06-20 12:54:58 +02:00
mlme.c wifi: cfg80211: fix assoc response warning on failed links 2023-10-23 13:25:30 +02:00
nl80211.c wifi: nl80211: reject cooked mode if it is set along with other flags 2025-03-13 12:58:26 +01:00
nl80211.h wifi: nl80211: Remove unused declaration nl80211_pmsr_dump_results() 2023-08-22 21:40:40 +02:00
ocb.c wifi: cfg80211: ocb: don't leave if not joined 2023-08-22 21:40:39 +02:00
of.c cfg80211: support ieee80211-freq-limit DT property 2017-01-06 14:01:13 +01:00
pmsr.c wifi: cfg80211: pmsr: use correct nla_get_uX functions 2024-06-21 14:38:12 +02:00
radiotap.c mac80211: Use flex-array for radiotap header bitmap 2021-08-13 09:58:25 +02:00
rdev-ops.h wifi: cfg80211: fix 6 GHz scan request building 2024-07-25 09:50:41 +02:00
reg.c wifi: cfg80211: regulatory: improve invalid hints checking 2025-03-13 12:58:26 +01:00
reg.h cfg80211: avoid holding the RTNL when calling the driver 2021-01-26 11:55:50 +01:00
scan.c wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation 2025-05-18 08:24:04 +02:00
sme.c wifi: cfg80211: sme: init n_channels before channels[] access 2024-12-19 18:11:27 +01:00
sysfs.c wifi: cfg80211: fully move wiphy work to unbound workqueue 2024-06-21 14:38:12 +02:00
sysfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
trace.c cfg80211: add tracing to rdev-ops 2012-10-18 10:53:37 +02:00
trace.h wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class 2024-06-12 11:11:22 +02:00
util.c wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() 2024-08-03 08:53:39 +02:00
wext-compat.c wifi: cfg80211: remove support for static WEP 2023-01-18 17:31:44 +01:00
wext-compat.h wifi: cfg80211: Avoid clashing function prototypes 2022-11-16 11:31:47 +02:00
wext-core.c wifi: cfg80211: add a flag to disable wireless extensions 2024-04-03 15:28:54 +02:00
wext-priv.c wext: fix potential private ioctl memory content leak 2010-09-20 13:41:40 -04:00
wext-proc.c proc: introduce proc_create_net{,_data} 2018-05-16 07:24:30 +02:00
wext-sme.c wifi: cfg80211: wext: hold wiphy lock in siwgenie 2023-06-07 19:53:11 +02:00
wext-spy.c wireless: wext-spy: Fix out-of-bounds warning 2021-06-23 10:57:17 +02:00