Anant Thazhemadam c37528577a net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() ... commit 3dc289f8f1 upstream. In nl80211_parse_key(), key.idx is first initialized as -1. If this value of key.idx remains unmodified and gets returned, and nl80211_key_allowed() also returns 0, then rdev_del_key() gets called with key.idx = -1. This causes an out-of-bounds array access. Handle this issue by checking if the value of key.idx after nl80211_parse_key() is called and return -EINVAL if key.idx < 0. Cc: stable@vger.kernel.org Reported-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com Tested-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com> Link: https://lore.kernel.org/r/20201007035401.9522-1-anant.thazhemadam@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-10-14 10:31:21 +02:00
..
certs	cfg80211: ship certificates as hex files	2017-12-19 09:28:01 +01:00
.gitignore	cfg80211: implement regdb signature checking	2017-10-11 14:24:24 +02:00
ap.c	cfg80211: call disconnect_wk when AP stops	2019-12-01 09:17:34 +01:00
chan.c	cfg80211: enable use of non-cleared DFS channels for DFS offload	2018-03-29 10:21:35 +02:00
core.c	{nl,mac}80211: fix interface combinations on crypto controlled devices	2019-09-16 08:21:42 +02:00
core.h	cfg80211: call disconnect_wk when AP stops	2019-12-01 09:17:34 +01:00
debugfs.c
debugfs.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
ethtool.c	cfg80211: check wiphy driver existence for drvinfo report	2020-03-05 16:42:13 +01:00
ibss.c	nl80211: Add SOCKET_OWNER support to JOIN_IBSS	2018-03-29 10:36:22 +02:00
Kconfig	cfg80211: add missing dependency to CFG80211 suboptions	2018-02-27 10:54:12 +01:00
lib80211_crypt_ccmp.c
lib80211_crypt_tkip.c	wireless/lib80211: Convert from ahash to shash	2018-07-24 09:17:20 +02:00
lib80211_crypt_wep.c
lib80211.c	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
Makefile	wireless: Skip directory when generating certificates	2019-11-10 11:27:54 +01:00
mesh.c	nl80211: Add SOCKET_OWNER support to JOIN_MESH	2018-03-29 10:38:24 +02:00
mlme.c	cfg80211: fix CAC_STARTED event handling	2018-03-29 10:21:16 +02:00
nl80211.c	net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()	2020-10-14 10:31:21 +02:00
nl80211.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
ocb.c
of.c
radiotap.c
rdev-ops.h	cfg80211: Fix radar event during another phy CAC	2020-02-05 14:43:46 +00:00
reg.c	cfg80211: regulatory: reject invalid hints	2020-09-09 19:04:32 +02:00
reg.h	cfg80211: implement regdb signature checking	2017-10-11 14:24:24 +02:00
scan.c	cfg80211: add and use strongly typed element iteration macros	2019-10-11 18:21:42 +02:00
sme.c	cfg80211: fix deadlocks in autodisconnect work	2020-01-23 08:21:33 +01:00
sysfs.c	cfg80211: track time using boottime	2018-06-29 09:49:28 +02:00
sysfs.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
trace.c
trace.h	cfg80211: Fix radar event during another phy CAC	2020-02-05 14:43:46 +00:00
util.c	cfg80211: fix page refcount issue in A-MSDU decap	2020-01-23 08:21:33 +01:00
wext-compat.c	cfg80211: initialize on-stack chandefs	2019-10-11 18:21:09 +02:00
wext-compat.h
wext-core.c	wireless: wext: avoid gcc -O3 warning	2020-02-05 14:43:46 +00:00
wext-priv.c
wext-proc.c	proc: introduce proc_create_net{,_data}	2018-05-16 07:24:30 +02:00
wext-sme.c	cfg80211: wext: avoid copying malformed SSIDs	2019-10-29 09:19:52 +01:00
wext-spy.c