Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1669417
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.9 14/60] mac80211: fix IBSS presp allocation size |
| Date | 2017-06-19 18:10 +0200 |
| Message-ID | <tU7py-4Ul-57@gated-at.bofh.it> (permalink) |
| References | <tU6MO-4pB-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit f1f3e9e2a50a70de908f9dfe0d870e9cdc67e042 upstream.
When VHT IBSS support was added, the size of the extra elements
wasn't considered in ieee80211_ibss_build_presp(), which makes
it possible that it would overrun the allocated buffer. Fix it
by allocating the necessary space.
Fixes: abcff6ef01f9 ("mac80211: add VHT support for IBSS")
Reported-by: Shaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/ibss.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -66,6 +66,8 @@ ieee80211_ibss_build_presp(struct ieee80
2 + (IEEE80211_MAX_SUPP_RATES - 8) +
2 + sizeof(struct ieee80211_ht_cap) +
2 + sizeof(struct ieee80211_ht_operation) +
+ 2 + sizeof(struct ieee80211_vht_cap) +
+ 2 + sizeof(struct ieee80211_vht_operation) +
ifibss->ie_len;
presp = kzalloc(sizeof(*presp) + frame_len, GFP_KERNEL);
if (!presp)
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.9 00/60] 4.9.34-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-19 18:10 +0200 [PATCH 4.9 06/60] [media] vb2: Fix an off by one error in vb2_plane_vaddr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-19 18:10 +0200 [PATCH 4.9 14/60] mac80211: fix IBSS presp allocation size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-19 18:10 +0200 [PATCH 4.9 37/60] USB: gadget: dummy_hcd: fix hub-descriptor removable fields Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-19 18:10 +0200 [PATCH 4.9 09/60] drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-19 18:10 +0200 [PATCH 4.9 15/60] mac80211: strictly check mesh address extension mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-19 18:10 +0200 [PATCH 4.9 22/60] x86/mm/32: Set the __vmalloc_start_set flag in initmem_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-19 18:10 +0200 [PATCH 4.9 13/60] mac80211: fix packet statistics for fast-RX Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-19 18:10 +0200
csiph-web