hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
linux-sg2042/net
History
John W. Linville 04045f98e0 [IEEE80211]: avoid integer underflow for runt rx frames 
Reported by Chris Evans <scarybeasts@gmail.com>:

> The summary is that an evil 80211 frame can crash out a victim's
> machine. It only applies to drivers using the 80211 wireless code, and
> only then to certain drivers (and even then depends on a card's
> firmware not dropping a dubious packet). I must confess I'm not
> keeping track of Linux wireless support, and the different protocol
> stacks etc.
>
> Details are as follows:
>
> ieee80211_rx() does not explicitly check that "skb->len >= hdrlen".
> There are other skb->len checks, but not enough to prevent a subtle
> off-by-two error if the frame has the IEEE80211_STYPE_QOS_DATA flag
> set.
>
> This leads to integer underflow and crash here:
>
> if (frag != 0)
>    flen -= hdrlen;
>
> (flen is subsequently used as a memcpy length parameter).

How about this?

Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 		2007-10-01 21:03:54 -07:00
..
9p 9p: fix bad error path in conversion routines 2007-08-23 10:25:05 -05:00
802 [SNAP]: Check packet length before reading 2007-08-21 20:58:13 -07:00
8021q [VLAN]: Fix net_device leak. 2007-09-16 16:43:04 -07:00
appletalk [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
atm [ATM]: Clean up duplicate includes in net/atm/ 2007-08-13 22:52:01 -07:00
ax25 [AX25]: don't free pointers to statically allocated data 2007-08-14 17:24:05 -07:00
bluetooth [BLUETOOTH]: Fix non-COMPAT build of hci_sock.c 2007-09-12 14:10:58 +02:00
bridge [NET] skbuff: Add skb_cow_head 2007-09-16 16:21:16 -07:00
core [PKTGEN]: srcmac fix 2007-09-16 14:52:15 -07:00
dccp [DCCP]: Allocation in atomic context 2007-08-21 20:58:06 -07:00
decnet [DECNET]: Fix interface address listing regression. 2007-09-11 10:45:15 +02:00
econet [ECONET]: remove econet_packet_type on unload 2007-08-14 17:25:20 -07:00
ethernet [ETH]: Validate address in eth_mac_addr 2007-07-11 19:41:18 -07:00
ieee80211 [IEEE80211]: avoid integer underflow for runt rx frames 2007-10-01 21:03:54 -07:00
ipv4 [TCP]: Fix MD5 signature handling on big-endian. 2007-09-28 15:18:35 -07:00
ipv6 [TCP]: Fix MD5 signature handling on big-endian. 2007-09-28 15:18:35 -07:00
ipx [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
irda [IRDA] irda_nl_get_mode: always results in failure 2007-08-21 21:23:39 -07:00
iucv [S390] Convert to smp_call_function_single. 2007-07-27 12:29:17 +02:00
key [PF_KEY]: Fix ipsec not working in 2.6.23-rc1-git10 2007-08-02 19:42:29 -07:00
lapb [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
llc [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
mac80211 [PATCH] mac80211: fix initialisation when built-in 2007-09-25 22:55:45 -07:00
netfilter [NETFILTER]: nfnetlink_log: fix sending of multipart messages 2007-09-20 12:13:52 -07:00
netlabel [NetLabel]: add missing rcu_dereference() calls in the LSM domain mapping hash table 2007-08-07 17:53:10 -07:00
netlink [GENETLINK]: Correctly report errors while registering a multicast group 2007-07-24 15:34:53 -07:00
netrom [NET] NETROM: Fix whitespace errors. 2007-07-19 10:44:32 +09:00
packet [NET] PACKET: Fix whitespace errors. 2007-07-19 10:44:35 +09:00
rfkill [NET] RFKILL: Fix whitespace errors. 2007-07-19 10:44:38 +09:00
rose [NET] ROSE: Fix whitespace errors. 2007-07-19 10:44:40 +09:00
rxrpc net/* misc endianness annotations 2007-07-26 11:11:56 -07:00
sched [SFQ]: Remove artificial limitation for queue limit. 2007-10-01 21:01:23 -07:00
sctp fix sctp_del_bind_addr() last argument type 2007-09-26 09:22:04 -07:00
sunrpc rpc: fix garbage in printk in svc_tcp_accept() 2007-09-20 13:15:57 -07:00
tipc [TIPC]: Clean up duplicate includes in net/tipc/ 2007-08-13 22:52:07 -07:00
unix [AF_UNIX]: Make code static. 2007-07-31 02:28:27 -07:00
wanrouter [NET]: Removal of duplicated include net/wanrouter/wanmain.c 2007-08-02 19:42:22 -07:00
wireless [PATCH] cfg80211: fix initialisation if built-in 2007-09-25 22:55:44 -07:00
x25 [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
xfrm [XFRM]: Clean up duplicate includes in net/xfrm/ 2007-08-13 22:52:08 -07:00
Kconfig 9p: Reorganization of 9p file system code 2007-07-14 15:13:40 -05:00
Makefile 9p: Reorganization of 9p file system code 2007-07-14 15:13:40 -05:00
TUNABLE
…
compat.c O_CLOEXEC for SCM_RIGHTS 2007-07-16 09:05:45 -07:00
nonet.c [PATCH] Make most file operations structs in fs/ const 2006-03-28 09:16:06 -08:00
socket.c [NET]: Zero length write() on socket should not simply return 0. 2007-09-27 13:52:00 -07:00
sysctl_net.c Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00