Johannes Berg 6646ce885f radiotap: fix bitmap-end-finding buffer overrun ...

commit bd02cd2549 upstream.

Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.

Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2014-01-09 12:24:23 -08:00

..

9p

9p: send uevent after adding/removing mount_tag attribute

2013-12-04 10:57:19 -08:00

802

net/802/mrp: fix lockdep splat

2013-05-14 13:02:30 -07:00

8021q

net: vlan: fix nlmsg size calculation in vlan_get_size()

2013-11-04 04:31:02 -08:00

appletalk

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

atm

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

ax25

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

batman-adv

batman-adv: set up network coding packet handlers during module init

2013-11-20 12:27:47 -08:00

bluetooth

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

bridge

bridge: flush br's address entry in fdb when remove the bridge dev

2013-12-08 07:29:26 -08:00

caif

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

can

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-05-01 17:51:54 -07:00

ceph

libceph: use pg_num_mask instead of pgp_num_mask for pg.seed calc

2013-09-26 17:18:29 -07:00

core

{pktgen, xfrm} Update IPv4 header total len and checksum after tranformation

2013-12-08 07:29:26 -08:00

dcb

rtnetlink: Remove passing of attributes into rtnl_doit functions

2013-03-22 10:31:16 -04:00

dccp

net:dccp: do not report ICMP redirects to user space

2013-10-13 16:08:30 -07:00

decnet

decnet: remove duplicated include from dn_table.c

2013-04-07 17:12:01 -04:00

dns_resolver

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

2012-12-16 15:40:50 -08:00

dsa

dsa: fix freeing of sparse port allocation

2013-03-25 12:23:41 -04:00

ethernet

net: add ETH_P_802_3_MIN

2013-03-28 01:20:42 -04:00

ieee802154

inet: prevent leakage of uninitialized memory to user in recv syscalls

2013-12-08 07:29:25 -08:00

ipv4

Revert "net: update consumers of MSG_MORE to recognize MSG_SENDPAGE_NOTLAST"

2013-12-20 07:45:12 -08:00

ipv6

ip6tnl: fix use after free of fb_tnl_dev

2013-12-20 07:45:11 -08:00

ipx

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

irda

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

iucv

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

key

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

l2tp

inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions

2013-12-08 07:29:25 -08:00

lapb

net/lapb: remove depends on CONFIG_EXPERIMENTAL

2013-01-11 11:40:01 -08:00

llc

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

mac80211

mac80211: don't attempt to reorder multicast frames

2013-12-20 07:45:09 -08:00

mac802154

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-04-30 03:55:20 -04:00

netfilter

netfilter: push reasm skb through instead of original frag skbs

2013-12-08 07:29:25 -08:00

netlabel

netlabel: improve domain mapping validation

2013-05-19 14:49:55 -07:00

netlink

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

netrom

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

nfc

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

openvswitch

openvswitch: Remove unneeded ovs_netdev_get_ifindex()

2013-04-30 00:19:11 -04:00

packet

af_packet: block BH in prb_shutdown_retire_blk_timer()

2013-12-08 07:29:26 -08:00

phonet

inet: prevent leakage of uninitialized memory to user in recv syscalls

2013-12-08 07:29:25 -08:00

rds

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

rfkill

Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

2013-04-22 14:58:14 -04:00

rose

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

rxrpc

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

sched

net_sched: htb: fix a typo in htb_change_class()

2013-10-13 16:08:29 -07:00

sctp

sctp: Perform software checksum if packet has to be fragmented.

2013-11-04 04:31:04 -08:00

sunrpc

SUNRPC: Fix a data corruption issue when retransmitting RPC calls

2013-11-29 11:11:52 -08:00

tipc

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

unix

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

vmw_vsock

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

wimax

…

wireless

radiotap: fix bitmap-end-finding buffer overrun

2014-01-09 12:24:23 -08:00

x25

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

xfrm

xfrm: force a garbage collection after deleting a policy

2013-05-31 17:30:07 -07:00

compat.c

net: clamp ->msg_namelen instead of returning an error

2013-12-08 07:29:25 -08:00

Kconfig

netlink: kconfig: move mmap i/o into netlink kconfig

2013-05-01 15:02:42 -04:00

Makefile

VSOCK: Introduce VM Sockets

2013-02-10 19:41:08 -05:00

nonet.c

…

socket.c

net: clamp ->msg_namelen instead of returning an error

2013-12-08 07:29:25 -08:00

sysctl_net.c

net: Update the sysctl permissions handler to test effective uid/gid

2013-10-13 16:08:34 -07:00