Srinivas Dasari 227ea2fde8 cfg80211: Check if NAN service ID is of expected size ...

commit 0a27844ce8 upstream.

nla policy checks for only maximum length of the attribute data when the
attribute type is NLA_BINARY. If userspace sends less data than
specified, cfg80211 may access illegal memory. When type is NLA_UNSPEC,
nla policy check ensures that userspace sends minimum specified length
number of bytes.

Remove type assignment to NLA_BINARY from nla_policy of
NL80211_NAN_FUNC_SERVICE_ID to make these NLA_UNSPEC and to make sure
minimum NL80211_NAN_FUNC_SERVICE_ID_LEN bytes are received from
userspace with NL80211_NAN_FUNC_SERVICE_ID.

Fixes: a442b761b2 ("cfg80211: add add_nan_func / del_nan_func")
Signed-off-by: Srinivas Dasari <dasaris@qti.qualcomm.com>
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-07-21 06:59:07 +02:00

..

.gitignore

…

ap.c

cfg80211: Make pre-CAC results valid only for ETSI domain

2017-03-06 13:54:15 +01:00

chan.c

cfg80211: Share Channel DFS state across wiphys of same DFS domain

2017-03-06 13:54:20 +01:00

core.c

cfg80211: add request id to cfg80211_sched_scan_*() api

2017-04-28 14:51:43 +02:00

core.h

cfg80211: add request id to cfg80211_sched_scan_*() api

2017-04-28 14:51:43 +02:00

db.txt

…

debugfs.c

cfg80211 debugfs: Cleanup some checkpatch issues

2017-02-08 09:15:59 +01:00

debugfs.h

…

ethtool.c

cfg80211: make ethtool the driver's responsibility

2014-06-23 11:05:33 +02:00

genregdb.awk

wireless: fixup genregdb.awk for remove of antenna gain from wireless-regd

2014-07-21 12:24:20 +02:00

ibss.c

cfg80211: Make pre-CAC results valid only for ETSI domain

2017-03-06 13:54:15 +01:00

Kconfig

cfg80211: Fix some linguistics in Kconfig

2016-02-24 09:04:23 +01:00

lib80211_crypt_ccmp.c

lib80211: ratelimit key index mismatch

2015-12-04 14:43:32 +01:00

lib80211_crypt_tkip.c

wireless: fix bogus maybe-uninitialized warning

2016-11-17 08:46:38 +02:00

lib80211_crypt_wep.c

lib80211: Use skcipher and ahash

2016-01-27 20:36:03 +08:00

lib80211.c

lib80211: remove unused print_ssid()

2014-10-14 02:18:27 +02:00

Makefile

Merge tag 'mac80211-next-for-davem-2017-01-13' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

2017-01-14 12:02:15 -05:00

mesh.c

cfg80211: Make pre-CAC results valid only for ETSI domain

2017-03-06 13:54:15 +01:00

mlme.c

cfg80211: Use a structure to pass connect response params

2017-03-31 08:31:26 +02:00

nl80211.c

cfg80211: Check if NAN service ID is of expected size

2017-07-21 06:59:07 +02:00

nl80211.h

cfg80211: unify cfg80211_roamed() and cfg80211_roamed_bss()

2017-04-28 12:28:44 +02:00

ocb.c

cfg80211: ocb: Fix null pointer deref if join_ocb is unimplemented

2015-12-04 14:43:32 +01:00

of.c

cfg80211: support ieee80211-freq-limit DT property

2017-01-06 14:01:13 +01:00

radiotap.c

cfg80211: add radiotap VHT info to rtap_namespace_sizes

2016-02-24 09:04:41 +01:00

rdev-ops.h

cfg80211: add request id parameter to .sched_scan_stop() signature

2017-04-26 23:17:40 +02:00

reg.c

cfg80211: Fix dfs state propagation for non-DFS center channel

2017-04-25 21:42:52 +02:00

reg.h

cfg80211: Share Channel DFS state across wiphys of same DFS domain

2017-03-06 13:54:20 +01:00

regdb.h

…

scan.c

cfg80211: make cfg80211_sched_scan_results() work from atomic context

2017-05-23 14:36:46 +02:00

sme.c

cfg80211: unify cfg80211_roamed() and cfg80211_roamed_bss()

2017-04-28 12:28:44 +02:00

sysfs.c

cfg80211: check rdev resume callback only for registered wiphy

2017-03-29 09:11:29 +02:00

sysfs.h

net: misc: Remove extern from function prototypes

2013-10-19 19:12:11 -04:00

trace.c

cfg80211: add tracing to rdev-ops

2012-10-18 10:53:37 +02:00

trace.h

cfg80211: add request id to cfg80211_sched_scan_*() api

2017-04-28 14:51:43 +02:00

util.c

mac80211: strictly check mesh address extension mode

2017-05-17 14:24:29 +02:00

wext-compat.c

cfg80211: move add/change interface monitor flags into params

2017-04-13 13:41:38 +02:00

wext-compat.h

cfg80211-wext: export symbols only when needed

2015-02-28 21:31:09 +01:00

wext-core.c

dev_ioctl: copy only the smaller struct iwreq for wext

2017-06-14 13:52:44 +02:00

wext-priv.c

…

wext-proc.c

net: proc: change proc_net_remove to remove_proc_entry

2013-02-18 14:53:08 -05:00

wext-sme.c

cfg80211: wext does not need to set monitor channel in managed mode

2017-01-11 14:10:44 +01:00

wext-spy.c

…