You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

John W. Linville 04045f98e0 [IEEE80211]: avoid integer underflow for runt rx frames ... Reported by Chris Evans <scarybeasts@gmail.com>: > The summary is that an evil 80211 frame can crash out a victim's > machine. It only applies to drivers using the 80211 wireless code, and > only then to certain drivers (and even then depends on a card's > firmware not dropping a dubious packet). I must confess I'm not > keeping track of Linux wireless support, and the different protocol > stacks etc. > > Details are as follows: > > ieee80211_rx() does not explicitly check that "skb->len >= hdrlen". > There are other skb->len checks, but not enough to prevent a subtle > off-by-two error if the frame has the IEEE80211_STYPE_QOS_DATA flag > set. > > This leads to integer underflow and crash here: > > if (frag != 0) > flen -= hdrlen; > > (flen is subsequently used as a memcpy length parameter). How about this? Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>		18 years ago
..
9p	9p: fix bad error path in conversion routines	18 years ago
802	[SNAP]: Check packet length before reading	18 years ago
8021q	[VLAN]: Fix net_device leak.	18 years ago
appletalk	…
atm	[ATM]: Clean up duplicate includes in net/atm/	18 years ago
ax25	[AX25]: don't free pointers to statically allocated data	18 years ago
bluetooth	[BLUETOOTH]: Fix non-COMPAT build of hci_sock.c	18 years ago
bridge	[NET] skbuff: Add skb_cow_head	18 years ago
core	[PKTGEN]: srcmac fix	18 years ago
dccp	[DCCP]: Allocation in atomic context	18 years ago
decnet	[DECNET]: Fix interface address listing regression.	18 years ago
econet	[ECONET]: remove econet_packet_type on unload	18 years ago
ethernet	…
ieee80211	[IEEE80211]: avoid integer underflow for runt rx frames	18 years ago
ipv4	[TCP]: Fix MD5 signature handling on big-endian.	18 years ago
ipv6	[TCP]: Fix MD5 signature handling on big-endian.	18 years ago
ipx	…
irda	[IRDA] irda_nl_get_mode: always results in failure	18 years ago
iucv	[S390] Convert to smp_call_function_single.	18 years ago
key	[PF_KEY]: Fix ipsec not working in 2.6.23-rc1-git10	18 years ago
lapb	…
llc	[NET]: Make all initialized struct seq_operations const.	18 years ago
mac80211	[PATCH] mac80211: fix initialisation when built-in	18 years ago
netfilter	[NETFILTER]: nfnetlink_log: fix sending of multipart messages	18 years ago
netlabel	[NetLabel]: add missing rcu_dereference() calls in the LSM domain mapping hash table	18 years ago
netlink	[GENETLINK]: Correctly report errors while registering a multicast group	18 years ago
netrom	…
packet	…
rfkill	…
rose	…
rxrpc	net/* misc endianness annotations	18 years ago
sched	[SFQ]: Remove artificial limitation for queue limit.	18 years ago
sctp	fix sctp_del_bind_addr() last argument type	18 years ago
sunrpc	rpc: fix garbage in printk in svc_tcp_accept()	18 years ago
tipc	[TIPC]: Clean up duplicate includes in net/tipc/	18 years ago
unix	[AF_UNIX]: Make code static.	18 years ago
wanrouter	[NET]: Removal of duplicated include net/wanrouter/wanmain.c	18 years ago
wireless	[PATCH] cfg80211: fix initialisation if built-in	18 years ago
x25	…
xfrm	[XFRM]: Clean up duplicate includes in net/xfrm/	18 years ago
Kconfig	…
Makefile	…
TUNABLE	…
compat.c	…
nonet.c	…
socket.c	[NET]: Zero length write() on socket should not simply return 0.	18 years ago
sysctl_net.c	…