kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/net/mac80211
History
Johannes Berg 15d4b0476f mac80211: fix use-after-free in defragmentation 
commit b8fff407a1 upstream.

Upon receiving the last fragment, all but the first fragment
are freed, but the multicast check for statistics at the end
of the function refers to the current skb (the last fragment)
causing a use-after-free bug.

Since multicast frames cannot be fragmented and we check for
this early in the function, just modify that check to also
do the accounting to fix the issue.

Reported-by: Yosef Khyal <yosefx.khyal@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2014-11-21 09:23:02 -08:00
..
aes_ccm.c mac80211: port CCMP to cryptoapi's CCM driver 2013-10-11 15:38:20 +02:00
aes_ccm.h mac80211: port CCMP to cryptoapi's CCM driver 2013-10-11 15:38:20 +02:00
aes_cmac.c mac80211: fix checkpatch errors 2013-12-18 10:33:06 +01:00
aes_cmac.h mac80211: fix checkpatch errors 2013-12-18 10:33:06 +01:00
agg-rx.c mac80211: improve aggregation debug messages 2013-01-18 21:55:15 +01:00
agg-tx.c mac80211: fix aggregation state with current drivers 2013-01-24 15:43:51 +01:00
cfg.c mac80211: release the channel in error path in start_ap 2014-02-06 09:55:20 +01:00
cfg.h [MAC80211]: rename ieee80211_cfg.h to cfg.h 2007-10-10 16:52:34 -07:00
chan.c mac80211: consider virtual mon when calculating min_def 2014-03-03 13:48:13 +01:00
debug.h mac80211: process the CSA frame for mesh accordingly 2013-10-28 15:05:28 +01:00
debugfs.c mac80211: Tx frame latency statistics 2013-12-02 11:51:50 +01:00
debugfs.h mac80211: use __printf attribute in debugfs 2012-10-18 09:01:57 +02:00
debugfs_key.c mac80211: move sdata debugfs dir to vif 2013-03-18 20:10:04 +01:00
debugfs_key.h mac80211: support separate default keys 2010-12-13 15:23:29 -05:00
debugfs_netdev.c mac80211: don't check netdev state for debugfs read/write 2014-07-09 11:18:26 -07:00
debugfs_netdev.h mac80211: reduce reliance on netdev 2009-12-21 18:38:52 -05:00
debugfs_sta.c mac80211: Tx frame latency statistics 2013-12-02 11:51:50 +01:00
debugfs_sta.h mac80211: RCU-ify STA info structure access 2008-03-06 15:30:46 -05:00
driver-ops.h mac80211: add pre-RCU-sync sta removal driver operation 2013-12-16 11:29:44 +01:00
event.c cfg80211: use proper allocation flags 2009-07-10 15:01:49 -04:00
ht.c mac80211: avoid deadlock revealed by lockdep 2014-02-06 09:55:18 +01:00
ibss.c mac80211: use secondary channel offset IE also beacons during CSA 2014-11-21 09:23:02 -08:00
ieee80211_i.h mac80211: use secondary channel offset IE also beacons during CSA 2014-11-21 09:23:02 -08:00
iface.c mac80211: properly flush delayed scan work on interface removal 2014-11-21 09:23:01 -08:00
Kconfig mac80211: process the CSA frame for mesh accordingly 2013-10-28 15:05:28 +01:00
key.c mac80211: free all AP/VLAN keys at once 2013-12-16 11:29:48 +01:00
key.h mac80211: free all AP/VLAN keys at once 2013-12-16 11:29:48 +01:00
led.c mac80211: use oneshot blink API for LED triggers 2013-08-01 10:48:49 +02:00
led.h mac80211: use oneshot blink API for LED triggers 2013-08-01 10:48:49 +02:00
main.c mac80211: exclude AP_VLAN interfaces from tx power calculation 2014-05-13 13:32:52 +02:00
Makefile mac80211: mesh power save basics 2013-02-04 18:57:47 +01:00
mesh.c mac80211: use secondary channel offset IE also beacons during CSA 2014-11-21 09:23:02 -08:00
mesh.h mac80211: use put_unaligned_le in mesh when necessary 2013-11-25 20:51:55 +01:00
mesh_hwmp.c mac80211: use put_unaligned_le in mesh when necessary 2013-11-25 20:51:55 +01:00
mesh_pathtbl.c mac80211: use put_unaligned_le in mesh when necessary 2013-11-25 20:51:55 +01:00
mesh_plink.c mac80211: enable WME for peer mesh STA 2014-01-06 17:43:06 +01:00
mesh_ps.c mac80211: clear sequence/fragment number in QoS-null frames 2014-03-05 15:49:54 +01:00
mesh_sync.c mac80211: update adjusting TBTT bit in beacon 2013-12-16 14:21:22 +01:00
michael.c mac80211: remove ieee80211_get_hdr_info 2008-07-08 14:16:01 -04:00
michael.h mac80211: remove ieee80211_get_hdr_info 2008-07-08 14:16:01 -04:00
mlme.c mac80211: schedule the actual switch of the station before CSA count 0 2014-11-21 09:23:02 -08:00
offchannel.c mac80211: fix on-channel remain-on-channel 2014-06-07 10:28:10 -07:00
pm.c mac80211: fix suspend vs. authentication race 2014-05-13 13:32:52 +02:00
rate.c mac80211: fix typo in starting baserate for rts_cts_rate_idx 2014-11-14 09:00:10 -08:00
rate.h Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next 2013-12-02 14:25:38 -05:00
rc80211_minstrel.c mac80211: fix checkpatch errors 2013-12-18 10:33:06 +01:00
rc80211_minstrel.h mac80211/minstrel: use the new rate control API 2013-04-22 16:16:41 +02:00
rc80211_minstrel_debugfs.c mac80211: cosmetics for minstrel_debugfs 2013-04-17 17:08:23 +02:00
rc80211_minstrel_ht.c mac80211: fix checkpatch errors 2013-12-18 10:33:06 +01:00
rc80211_minstrel_ht.h mac80211/minstrel_ht: use the new rate control API 2013-04-22 16:16:41 +02:00
rc80211_minstrel_ht_debugfs.c mac80211: minstrel_ht: replace some occurences of MCS_GROUP_RATES 2013-11-25 20:52:07 +01:00
rc80211_pid.h Fix common misspellings 2011-03-31 11:26:23 -03:00
rc80211_pid_algo.c mac80211/rc80211: add chandef to rate initialization 2013-07-16 09:58:02 +03:00
rc80211_pid_debugfs.c mac80211: fix some snprintf misuses 2013-10-01 12:16:51 +02:00
rx.c mac80211: fix use-after-free in defragmentation 2014-11-21 09:23:02 -08:00
scan.c mac80211: reschedule sched scan after HW restart 2013-12-16 13:47:26 +01:00
spectmgmt.c mac80211: use secondary channel offset IE also beacons during CSA 2014-11-21 09:23:02 -08:00
sta_info.c mac80211: fix a memory leak on sta rate selection table 2014-07-09 11:18:26 -07:00
sta_info.h mac80211: fix AP powersave TX vs. wakeup race 2014-02-20 10:32:29 +01:00
status.c mac80211: Tx frame latency statistics 2013-12-02 11:51:50 +01:00
tkip.c mac80211: fix checkpatch errors 2013-12-18 10:33:06 +01:00
tkip.h mac80211: fix TKIP races, make API easier to use 2011-07-08 11:11:19 -04:00
trace.c mac80211: trace debug messages 2012-06-24 11:33:18 +02:00
trace.h mac80211: add tracing for ieee80211_sta_set_buffered 2014-01-06 12:09:01 +01:00
tx.c Revert "mac80211: move "bufferable MMPDU" check to fix AP mode scan" 2014-08-07 14:52:38 -07:00
util.c mac80211: fix nested rtnl locking on ieee80211_reconfig 2014-06-07 10:28:10 -07:00
vht.c mac80211: enable easier manipulation of VHT beamforming caps 2013-11-25 20:52:01 +01:00
wep.c wireless: move crypto constants to ieee80211.h 2013-05-16 22:39:41 +02:00
wep.h mac80211: move RX WEP weak IV counting 2012-03-13 14:54:16 -04:00
wme.c mac80211: send control port protocol frames to the VO queue 2014-02-12 11:26:43 +01:00
wme.h mac80211: save wmm_acm per sdata 2012-06-20 17:35:22 +02:00
wpa.c mac80211: clean up garbage in comment 2014-01-07 16:21:56 +01:00
wpa.h mac80211: add generic cipher scheme support 2013-11-25 20:50:52 +01:00