kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/net/wireless
History
Dan Williams c270bd1cc6 nl80211: Sanitize array index in parse_txq_params 
commit 259d8c1e98 upstream.

Wireless drivers rely on parse_txq_params to validate that txq_params->ac
is less than NL80211_NUM_ACS by the time the low-level driver's ->conf_tx()
handler is called. Use a new helper, array_index_nospec(), to sanitize
txq_params->ac with respect to speculation. I.e. ensure that any
speculation into ->conf_tx() handlers is done with a value of
txq_params->ac that is within the bounds of [0, NL80211_NUM_ACS).

Reported-by: Christian Lamparter <chunkeey@gmail.com>
Reported-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Cc: linux-arch@vger.kernel.org
Cc: kernel-hardening@lists.openwall.com
Cc: gregkh@linuxfoundation.org
Cc: linux-wireless@vger.kernel.org
Cc: torvalds@linux-foundation.org
Cc: "David S. Miller" <davem@davemloft.net>
Cc: alan@linux.intel.com
Link: https://lkml.kernel.org/r/151727419584.33451.7700736761686184303.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-03-19 18:59:14 +00:00
..
.gitignore wireless: support internal statically compiled regulatory database 2009-12-21 18:56:10 -05:00
ap.c cfg80211: export interface stopping function 2014-05-06 15:16:34 +02:00
chan.c cfg80211: Fix 160 MHz channels with 80+80 and 160 MHz drivers 2015-01-15 10:44:02 +00:00
core.c cfg80211: check dev_set_name() return value 2018-03-03 15:52:23 +00:00
core.h mac80211_hwsim: validate number of different channels 2018-03-03 15:52:22 +00:00
db.txt wireless: support internal statically compiled regulatory database 2009-12-21 18:56:10 -05:00
debugfs.c mac80211: fix some snprintf misuses 2013-10-01 12:16:51 +02:00
debugfs.h cfg80211/mac80211: use debugfs_remove_recursive 2009-10-30 16:49:18 -04:00
ethtool.c cfg80211: change wiphy_to_dev function name 2014-04-25 17:33:04 +02:00
ethtool.h net/wireless/ethtool.h: drop unnecessary include of linux/ethtool.h 2009-10-07 16:39:49 -04:00
genregdb.awk regdb: Generalize the mW to dBm power conversion 2014-05-27 17:58:58 +02:00
ibss.c cfg80211: constify more pointers in the cfg80211 API 2014-05-19 17:53:16 +02:00
Kconfig cfg80211: Enable GO operation on additional channels 2014-04-09 10:55:34 +02:00
lib80211.c lib80211: remove exports for functions not called by other modules 2011-08-09 15:42:36 -04:00
lib80211_crypt_ccmp.c hostap: Don't use create_proc_read_entry() 2013-04-29 15:41:56 -04:00
lib80211_crypt_tkip.c hostap: Don't use create_proc_read_entry() 2013-04-29 15:41:56 -04:00
lib80211_crypt_wep.c hostap: Don't use create_proc_read_entry() 2013-04-29 15:41:56 -04:00
Makefile cfg80211: add tracing to rdev-ops 2012-10-18 10:53:37 +02:00
mesh.c cfg80211: export interface stopping function 2014-05-06 15:16:34 +02:00
mlme.c cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts 2017-03-16 02:26:32 +00:00
nl80211.c nl80211: Sanitize array index in parse_txq_params 2018-03-19 18:59:14 +00:00
nl80211.h cfg80211: send events when devices are added/removed 2014-05-26 13:52:25 +02:00
radiotap.c radiotap: fix bitmap-end-finding buffer overrun 2013-12-16 12:06:43 +01:00
rdev-ops.h cfg80211: implement cfg80211_get_station cfg80211 API 2014-05-21 09:15:17 +02:00
reg.c cfg80211: don't WARN about two consecutive Country IE hint 2015-01-15 10:44:04 +00:00
reg.h cfg80211: Enable GO operation on indoor channels 2014-04-09 10:55:37 +02:00
regdb.h cfg80211: relicense reg.c reg.h and genregdb.awk to ISC 2012-01-04 14:30:41 -05:00
scan.c cfg80211: limit scan results cache size 2017-02-23 03:54:37 +00:00
sme.c cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts 2017-03-16 02:26:32 +00:00
sysfs.c net: wireless: convert class code to use dev_groups 2013-07-25 16:34:40 -07:00
sysfs.h net: misc: Remove extern from function prototypes 2013-10-19 19:12:11 -04:00
trace.c cfg80211: add tracing to rdev-ops 2012-10-18 10:53:37 +02:00
trace.h cfg80211: fix mic_failure tracing 2014-07-18 09:53:56 +02:00
util.c mac80211: strictly check mesh address extension mode 2017-09-15 18:29:42 +01:00
wext-compat.c cfg80211: fix station info handling bugs 2018-03-03 15:52:26 +00:00
wext-compat.h cfg80211: remove unused wiphy argument from cfg80211_wext_freq() 2014-04-10 10:06:19 +02:00
wext-core.c cfg80211/wext: fix message ordering 2016-03-24 10:01:07 +00:00
wext-priv.c wext: fix potential private ioctl memory content leak 2010-09-20 13:41:40 -04:00
wext-proc.c net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
wext-sme.c cfg80211: change wiphy_to_dev function name 2014-04-25 17:33:04 +02:00
wext-spy.c wireless: Convert compare_ether_addr to ether_addr_equal 2012-05-09 20:49:19 -04:00