leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
4253119acf
linux/net
History
Johannes Berg 4253119acf mac80211: fix two remote exploits 
Lennert Buytenhek noticed a remotely triggerable problem
in mac80211, which is due to some code shuffling I did
that ended up changing the order in which things were
done -- this was in

  commit d75636ef9c
  Author: Johannes Berg <johannes@sipsolutions.net>
  Date:   Tue Feb 10 21:25:53 2009 +0100

    mac80211: RX aggregation: clean up stop session

The problem is that the BUG_ON moved before the various
checks, and as such can be triggered.

As the comment indicates, the BUG_ON can be removed since
the ampdu_action callback must already exist when the
state is OPERATIONAL.

A similar code path leads to a WARN_ON in
ieee80211_stop_tx_ba_session, which can also be removed.

Cc: stable@kernel.org [2.6.29+]
Cc: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-30 13:52:21 -05:00
..
9p 9p: fix readdir corner cases 2009-11-02 08:43:45 -06:00
802 net: remove COMPAT_NET_DEV_OPS 2009-05-25 01:53:53 -07:00
8021q vlan: Fix register_vlan_dev() error path 2009-11-17 06:45:04 -08:00
appletalk Have atalk_route_packet() return NET_RX_SUCCESS not NET_XMIT_SUCCESS 2009-09-14 17:02:47 -07:00
atm net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
ax25 ax25: Fix possible oops in ax25_make_new 2009-09-30 16:44:12 -07:00
bluetooth Bluetooth: Fix regression with L2CAP configuration in Basic Mode 2009-11-16 01:31:41 +01:00
bridge bridge: prevent bridging wrong device 2009-11-05 20:46:52 -08:00
can can: should not use __dev_get_by_index() without locks 2009-11-08 00:33:43 -08:00
core pktgen: Fix netdevice unregister 2009-11-24 14:50:53 -08:00
dcb net: fix double skb free in dcbnl 2009-09-26 20:16:15 -07:00
dccp net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
decnet decnet: netdevice refcount leak 2009-11-06 00:50:39 -08:00
dsa netdev: convert pseudo-devices to netdev_tx_t 2009-09-01 01:13:07 -07:00
econet Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-08-12 17:44:53 -07:00
ethernet net: remove COMPAT_NET_DEV_OPS 2009-05-25 01:53:53 -07:00
ieee802154 net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
ipv4 ipmr: missing dev_put() on error path in vif_add() 2009-11-13 19:56:54 -08:00
ipv6 net: fix sk_forward_alloc corruption 2009-10-30 12:25:12 -07:00
ipx net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
irda headers: remove sched.h from interrupt.h 2009-10-11 11:20:58 -07:00
iucv net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
key net: file_operations should be const 2009-09-02 01:03:53 -07:00
lapb net: remove NET_RX_BAD and NET_RX_CN* defines 2009-07-05 19:15:35 -07:00
llc net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
mac80211 mac80211: fix two remote exploits 2009-11-30 13:52:21 -05:00
netfilter Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6 2009-11-23 09:52:51 -08:00
netlabel Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-07-30 19:22:43 -07:00
netlink net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
netrom net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
packet Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2009-10-29 09:22:08 -07:00
phonet Phonet: fix mutex imbalance 2009-09-30 16:41:34 -07:00
rds net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
rfkill Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 2009-11-23 14:01:47 -08:00
rose rose: device refcount leak 2009-11-05 20:56:07 -08:00
rxrpc net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
sched pkt_sched: pedit use proper struct 2009-10-11 23:03:47 -07:00
sctp sctp: Set socket source address when additing first transport 2009-11-13 19:56:52 -08:00
sunrpc Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2009-11-03 07:44:01 -08:00
tipc net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
unix AF_UNIX: Fix deadlock on connecting to shutdown socket 2009-10-18 23:17:37 -07:00
wanrouter headers: smp_lock.h redux 2009-07-12 12:22:34 -07:00
wimax wimax: fix warning caused by not checking retval of rfkill_set_hw_state() 2009-06-11 11:12:48 -07:00
wireless Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2009-11-03 07:44:01 -08:00
x25 net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
xfrm net: file_operations should be const 2009-09-02 01:03:53 -07:00
compat.c net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
Kconfig net/compat/wext: send different messages to compat tasks 2009-07-15 08:53:39 -07:00
Makefile net: remove redundant sched/ in net/Makefile 2009-07-12 20:11:14 -07:00
nonet.c
socket.c net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
sysctl_net.c net: sysctl_net - use net_eq to compare nets 2009-03-16 16:23:30 +01:00
TUNABLE