Johannes Berg f5563318ff wireless: radiotap: fix parsing buffer overrun ... When parsing an invalid radiotap header, the parser can overrun the buffer that is passed in because it doesn't correctly check 1) the minimum radiotap header size 2) the space for extended bitmaps The first issue doesn't affect any in-kernel user as they all check the minimum size before calling the radiotap function. The second issue could potentially affect the kernel if an skb is passed in that consists only of the radiotap header with a lot of extended bitmaps that extend past the SKB. In that case a read-only buffer overrun by at most 4 bytes is possible. Fix this by adding the appropriate checks to the parser. Cc: stable@vger.kernel.org Reported-by: Evan Huus <eapache@gmail.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>		2013-10-14 09:47:00 +02:00
..
9p	for-linus-3.12-merge minor 9p fixes and tweaks for 3.12 merge window	2013-09-11 12:34:13 -07:00
802	net/802/mrp: fix lockdep splat	2013-05-14 13:02:30 -07:00
8021q	net: vlan: inherit addr_assign_type along with dev_addr	2013-09-03 20:57:49 -04:00
appletalk	net: proc_fs: trivial: print UIDs as unsigned int	2013-08-15 14:37:46 -07:00
atm	net: always pass struct netdev_notifier_info to netdevice notifiers	2013-05-28 21:58:54 -07:00
ax25	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
batman-adv	batman: Remove reference to compare_ether_addr	2013-09-03 22:34:48 -04:00
bluetooth	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid	2013-09-06 09:30:36 -07:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-09-05 14:54:29 -07:00
caif	caif: Add missing braces to multiline if in cfctrl_linkup_request	2013-09-05 14:31:02 -04:00
can	can: gw: add a per rule limitation of frame hops	2013-08-29 22:58:24 +02:00
ceph	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client	2013-09-09 09:13:22 -07:00
core	net: fix multiqueue selection	2013-09-11 16:10:00 -04:00
dcb	rtnetlink: Remove passing of attributes into rtnl_doit functions	2013-03-22 10:31:16 -04:00
dccp	net: add sk_stream_is_writeable() helper	2013-07-24 17:54:48 -07:00
decnet	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
dns_resolver	net: strict_strtoul is obsolete, use kstrtoul instead	2013-07-12 16:09:14 -07:00
dsa	net: dsa: inherit addr_assign_type along with dev_addr	2013-09-03 20:57:49 -04:00
ethernet	net: Fix sysfs_format_mac() code duplication.	2013-07-16 17:09:22 -07:00
ieee802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-09-05 14:54:29 -07:00
ipv4	memcg: rename RESOURCE_MAX to RES_COUNTER_MAX	2013-09-12 15:38:02 -07:00
ipv6	ipv6: don't call fib6_run_gc() until routing is ready	2013-09-11 17:04:09 -04:00
ipx	net: proc_fs: trivial: print UIDs as unsigned int	2013-08-15 14:37:46 -07:00
irda	net/irda: fixed style issues in irttp	2013-07-19 17:34:40 -07:00
iucv	net: delete __cpuinit usage from all net files	2013-07-14 19:36:58 -04:00
key	xfrm: Remove rebundant address family checking	2013-08-07 10:12:58 +02:00
l2tp	l2tp: make datapath resilient to packet loss when sequence numbers enabled	2013-07-02 16:33:25 -07:00
lapb
llc	llc: Use normal etherdevice.h tests	2013-09-03 22:34:47 -04:00
mac80211	mac80211: correctly close cancelled scans	2013-10-09 18:40:07 +02:00
mac802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-04-30 03:55:20 -04:00
mpls	MPLS: Add limited GSO support	2013-05-27 22:50:59 -07:00
netfilter	netfilter: Fix build errors with xt_socket.c	2013-09-05 14:38:03 -04:00
netlabel	netlabel: use domain based selectors when address based selectors are not available	2013-08-02 16:57:01 -07:00
netlink	net: netlink: filter particular protocols from analyzers	2013-09-06 14:43:48 -04:00
netrom	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
nfc	NFC: Update secure element state	2013-08-14 01:13:40 +02:00
openvswitch	net: ovs: flow: fix potential illegal memory access in __parse_flow_nlattrs	2013-09-11 16:09:58 -04:00
packet	net: packet: use reciprocal_divide in fanout_demux_hash	2013-08-29 16:43:29 -04:00
phonet	net: proc_fs: trivial: print UIDs as unsigned int	2013-08-15 14:37:46 -07:00
rds	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
rfkill	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-09-05 14:54:29 -07:00
rose	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
rxrpc
sched	net_sched: htb: fix a typo in htb_change_class()	2013-09-11 17:16:22 -04:00
sctp	net: sctp: fix smatch warning in sctp_send_asconf_del_ip	2013-09-11 16:10:00 -04:00
sunrpc	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-09-12 15:01:38 -07:00
tipc	tipc: set sk_err correctly when connection fails	2013-08-30 16:06:57 -04:00
unix	af_unix: fix bug on large send()	2013-08-11 22:02:36 -07:00
vmw_vsock	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-08-16 15:37:26 -07:00
wimax
wireless	wireless: radiotap: fix parsing buffer overrun	2013-10-14 09:47:00 +02:00
x25	x25: add a sanity check parsing X.25 facilities	2013-09-04 00:27:27 -04:00
xfrm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-09-05 14:58:52 -04:00
compat.c	net: Unbreak compat_sys_{send,recv}msg	2013-06-06 11:52:14 -07:00
Kconfig	Remove GENERIC_HARDIRQ config option	2013-09-13 15:09:52 +02:00
Makefile	MPLS: Add limited GSO support	2013-05-27 22:50:59 -07:00
nonet.c
socket.c	Merge git://git.kvack.org/~bcrl/aio-next	2013-09-13 10:55:58 -07:00
sysctl_net.c