Kenton Groombridge 2663d0462e wifi: mac80211: Avoid address calculations via out of bounds array indexing ... req->n_channels must be set before req->channels[] can be used. This patch fixes one of the issues encountered in [1]. [ 83.964255] UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:364:4 [ 83.964258] index 0 is out of range for type 'struct ieee80211_channel *[]' [...] [ 83.964264] Call Trace: [ 83.964267] <TASK> [ 83.964269] dump_stack_lvl+0x3f/0xc0 [ 83.964274] __ubsan_handle_out_of_bounds+0xec/0x110 [ 83.964278] ieee80211_prep_hw_scan+0x2db/0x4b0 [ 83.964281] __ieee80211_start_scan+0x601/0x990 [ 83.964291] nl80211_trigger_scan+0x874/0x980 [ 83.964295] genl_family_rcv_msg_doit+0xe8/0x160 [ 83.964298] genl_rcv_msg+0x240/0x270 [...] [1] https://bugzilla.kernel.org/show_bug.cgi?id=218810 Co-authored-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kees Cook <kees@kernel.org> Signed-off-by: Kenton Groombridge <concord@gentoo.org> Link: https://msgid.link/20240605152218.236061-1-concord@gentoo.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>		2024-06-14 09:08:41 +02:00
..
6lowpan
9p	virtio: features, fixes, cleanups	2024-05-23 12:04:36 -07:00
802
8021q	net: annotate writes on dev->mtu from ndo_change_mtu()	2024-05-07 16:19:14 -07:00
appletalk	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-05-09 10:01:01 -07:00
atm	net: change proto and proto_ops accept type	2024-05-13 18:19:09 -06:00
ax25	net-accept-more-20240515	2024-05-18 10:32:39 -07:00
batman-adv	tracing/treewide: Remove second parameter of __assign_str()	2024-05-22 20:14:47 -04:00
bluetooth	net-accept-more-20240515	2024-05-18 10:32:39 -07:00
bpf	bpf: check bpf_dummy_struct_ops program params for test runs	2024-04-25 12:42:43 -07:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2024-05-15 07:30:49 -07:00
caif
can
ceph
core	dma-mapping updates for Linux 6.10	2024-05-20 10:23:39 -07:00
dcb
dccp	net: dccp: Fix ccid2_rtt_estimator() kernel-doc	2024-05-07 16:15:08 -07:00
devlink	devlink: extend devlink_param *set pointer	2024-04-22 13:05:19 -07:00
dns_resolver
dsa	tracing/treewide: Remove second parameter of __assign_str()	2024-05-22 20:14:47 -04:00
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-04-25 08:20:54 -07:00
ethtool	net: revert partially applied PHY topology series	2024-05-13 18:35:02 -07:00
handshake	net/handshake: remove redundant assignment to variable ret	2024-04-16 17:14:55 -07:00
hsr	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-05-09 10:01:01 -07:00
ieee802154	tracing/treewide: Remove second parameter of __assign_str()	2024-05-22 20:14:47 -04:00
ife
ipv4	Quite smaller than usual. Notably it includes the fix for the unix	2024-05-23 12:49:37 -07:00
ipv6	ipv6: sr: fix memleak in seg6_hmac_init_algo	2024-05-21 13:16:25 +02:00
iucv	more s390 updates for 6.10 merge window	2024-05-21 12:09:36 -07:00
kcm
key
l2tp	l2tp: fix ICMP error handling for UDP-encap sockets	2024-05-17 12:15:22 -07:00
l3mdev
lapb
llc	net: change proto and proto_ops accept type	2024-05-13 18:19:09 -06:00
mac80211	wifi: mac80211: Avoid address calculations via out of bounds array indexing	2024-06-14 09:08:41 +02:00
mac802154
mctp
mpls	net: Remove the now superfluous sentinel elements from ctl_table array	2024-05-03 13:29:41 +01:00
mptcp	net-accept-more-20240515	2024-05-18 10:32:39 -07:00
ncsi
netfilter	netfilter pull request 24-05-12	2024-05-13 13:12:35 -07:00
netlabel	netlabel: fix RCU annotation for IPv4 options on socket creation	2024-05-13 14:58:12 -07:00
netlink	netlink: support all extack types in dumps	2024-04-23 10:09:49 -07:00
netrom	net-accept-more-20240515	2024-05-18 10:32:39 -07:00
nfc	Quite smaller than usual. Notably it includes the fix for the unix	2024-05-23 12:49:37 -07:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-04-26 12:20:01 +02:00
openvswitch	Quite smaller than usual. Notably it includes the fix for the unix	2024-05-23 12:49:37 -07:00
packet	af_packet: do not call packet_read_pending() from tpacket_destruct_skb()	2024-05-16 19:38:05 -07:00
phonet	net: change proto and proto_ops accept type	2024-05-13 18:19:09 -06:00
psample
qrtr	net: qrtr: ns: Fix module refcnt	2024-05-16 09:47:45 +01:00
rds	net: change proto and proto_ops accept type	2024-05-13 18:19:09 -06:00
rfkill
rose	net: change proto and proto_ops accept type	2024-05-13 18:19:09 -06:00
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-05-09 10:01:01 -07:00
sched	net/sched: adjust device watchdog timer to detect stopped queue at right time	2024-05-09 20:24:13 -07:00
sctp	net: change proto and proto_ops accept type	2024-05-13 18:19:09 -06:00
smc	tracing/treewide: Remove second parameter of __assign_str()	2024-05-22 20:14:47 -04:00
strparser
sunrpc	NFS client updates for Linux 6.10	2024-05-23 13:51:09 -07:00
switchdev	net: bridge: switchdev: Improve error message for port_obj_add/del functions	2024-05-08 12:19:12 +01:00
tipc	tracing/treewide: Remove second parameter of __assign_str()	2024-05-22 20:14:47 -04:00
tls	tls: fix missing memory barrier in tls_init	2024-05-23 12:03:26 +02:00
unix	Quite smaller than usual. Notably it includes the fix for the unix	2024-05-23 12:49:37 -07:00
vmw_vsock	virtio: features, fixes, cleanups	2024-05-23 12:04:36 -07:00
wireless	wifi: cfg80211: wext: add extra SIOCSIWSCAN data check	2024-06-12 10:07:56 +02:00
x25	net: change proto and proto_ops accept type	2024-05-13 18:19:09 -06:00
xdp	xsk: use generic DMA sync shortcut instead of a custom one	2024-05-08 08:51:20 +02:00
xfrm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-05-09 10:01:01 -07:00
compat.c
devres.c
Kconfig	net: add IEEE 802.1q specific helpers	2024-05-08 10:35:09 +01:00
Kconfig.debug
Makefile
socket.c	net: have do_accept() take a struct proto_accept_arg argument	2024-05-13 18:19:19 -06:00
sysctl_net.c	sysctl: treewide: constify argument ctl_table_root::permissions(table)	2024-04-24 09:43:54 +02:00