Kees Cook e0e29b683d b43: stop format string leaking into error msgs ... The module parameter "fwpostfix" is userspace controllable, unfiltered, and is used to define the firmware filename. b43_do_request_fw() populates ctx->errors[] on error, containing the firmware filename. b43err() parses its arguments as a format string. For systems with b43 hardware, this could lead to a uid-0 to ring-0 escalation. CVE-2013-2852 Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com>		2013-06-12 10:20:59 -04:00
..
Kconfig	b43: HT-PHY: make it BCMA-only	2013-03-06 16:28:59 -05:00
Makefile	b43: N-PHY: init 0x2057 radio	2012-08-06 14:56:35 -04:00
b43.h	Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next	2013-04-10 14:09:54 -04:00
bus.c	bcma: add boardinfo struct	2012-05-16 12:45:21 -04:00
bus.h	…
debugfs.c	simple_open: automatically convert to simple_open()	2012-04-05 15:25:50 -07:00
debugfs.h	…
dma.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem	2013-05-10 10:29:24 -04:00
dma.h	B43: Handle DMA RX descriptor underrun	2013-05-08 17:15:06 -04:00
leds.c	net: fix assignment of 0/1 to bool variables.	2011-12-19 22:27:29 -05:00
leds.h	…
lo.c	net: fix assignment of 0/1 to bool variables.	2011-12-19 22:27:29 -05:00
lo.h	…
main.c	b43: stop format string leaking into error msgs	2013-06-12 10:20:59 -04:00
main.h	b43: Fix firmware loading when driver is built into the kernel	2013-01-07 14:34:45 -05:00
pcmcia.c	drivers/net: use module_pcmcia_driver() in pcmcia drivers	2013-03-15 12:27:33 -07:00
pcmcia.h	…
phy_a.c	…
phy_a.h	…
phy_common.c	b43: add helper waiting for given value in radio reg	2012-08-06 14:56:35 -04:00
phy_common.h	b43: add helper waiting for given value in radio reg	2012-08-06 14:56:35 -04:00
phy_g.c	net: fix assignment of 0/1 to bool variables.	2011-12-19 22:27:29 -05:00
phy_g.h	…
phy_ht.c	b43: HT-PHY: use enum for RSSI types	2013-04-23 12:27:56 +02:00
phy_ht.h	b43: HT-PHY: define regs for power estimation	2013-04-23 12:27:56 +02:00
phy_lcn.c	mac80211: Use a cfg80211_chan_def in ieee80211_hw_conf_chan	2013-03-25 19:19:35 +01:00
phy_lcn.h	…
phy_lp.c	b43: use defines for board_type	2013-04-23 12:27:57 +02:00
phy_lp.h	…
phy_n.c	Merge branch 'master' of git://git.infradead.org/users/rafal/b43-next	2013-04-23 14:10:10 -04:00
phy_n.h	b43: N-PHY: define missing registers	2013-04-23 12:27:57 +02:00
pio.c	b43: fix tx path skb leaks	2012-12-10 15:49:59 -05:00
pio.h	…
radio_2055.c	…
radio_2055.h	…
radio_2056.c	b43: make struct b2056_inittabs_pts const	2013-04-01 16:06:50 -04:00
radio_2056.h	b43: N-PHY: finish 2.4GHz 0x2056 radio setup	2011-12-13 15:33:56 -05:00
radio_2057.c	b43: N-PHY: init 0x2057 radio	2012-08-06 14:56:35 -04:00
radio_2057.h	b43: N-PHY: init 0x2057 radio	2012-08-06 14:56:35 -04:00
radio_2059.c	b43: HT-PHY: tables: don't duplicate core-generic regs	2013-04-23 12:27:55 +02:00
radio_2059.h	b43: HT-PHY: tables: don't duplicate core-generic regs	2013-04-23 12:27:55 +02:00
rfkill.c	…
rfkill.h	…
sdio.c	b43: remove __dev* attributes	2012-12-06 15:04:56 -05:00
sdio.h	b43: mark some functions and structs static	2013-04-01 16:06:50 -04:00
sysfs.c	…
sysfs.h	…
tables.c	…
tables.h	…
tables_lpphy.c	…
tables_lpphy.h	…
tables_nphy.c	b43: N-PHY: clean init tables	2013-04-23 12:27:58 +02:00
tables_nphy.h	b43: N-PHY: clean init tables	2013-04-23 12:27:58 +02:00
tables_phy_ht.c	…
tables_phy_ht.h	…
tables_phy_lcn.c	b43: mark some functions and structs static	2013-04-01 16:06:50 -04:00
tables_phy_lcn.h	…
wa.c	…
wa.h	…
xmit.c	mac80211: support RX_FLAG_MACTIME_END	2012-11-13 21:43:55 +01:00
xmit.h	b43: HT-PHY: report signal to mac80211	2011-11-07 13:19:12 -05:00