Arend Van Spriel ded8991215 brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap() ...

User-space can choose to omit NL80211_ATTR_SSID and only provide raw
IE TLV data. When doing so it can provide SSID IE with length exceeding
the allowed size. The driver further processes this IE copying it
into a local variable without checking the length. Hence stack can be
corrupted and used as exploit.

Cc: stable@vger.kernel.org # v4.7
Reported-by: Daxing Guo <freener.gdx@gmail.com>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

2016-09-07 16:43:50 +03:00

..

bcdc.c

brcmf: Fix null pointer exception in bcdc_hdrpull

2016-04-26 12:18:37 +03:00

bcdc.h

…

bcmsdh.c

brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain

2016-07-19 21:14:19 +03:00

btcoex.c

brcmfmac: use jiffies for timeout in btcoex

2016-01-08 10:44:46 +02:00

btcoex.h

…

bus.h

brcmfmac: revise handling events in receive path

2016-04-14 15:57:52 +03:00

cfg80211.c

brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap()

2016-09-07 16:43:50 +03:00

cfg80211.h

brcmfmac: Change vif_event_lock to spinlock

2016-08-24 16:13:48 +03:00

chip.c

brcmfmac: add support for the PCIE devices 43525 and 43465

2016-06-16 18:20:05 +03:00

chip.h

brcmfmac: access PMU registers using standalone PMU core if available

2016-02-06 13:52:47 +02:00

common.c

brcmfmac: add support for nl80211 BSS_SELECT feature

2016-04-26 12:14:27 +03:00

common.h

brcmfmac: merge platform data and module paramaters

2016-03-07 14:15:56 +02:00

commonring.c

…

commonring.h

…

core.c

brcmfmac: Check rtnl_lock is locked when removing interface

2016-08-24 16:13:47 +03:00

core.h

brcmfmac: use const char * for interface name in brcmf_add_if

2016-06-29 18:59:59 +03:00

debug.c

brcmfmac: Use consistent naming for bsscfgidx.

2015-11-26 13:55:18 +02:00

debug.h

brcmfmac: assure net_ratelimit() is declared before use

2015-11-30 14:46:45 +02:00

feature.c

brcmfmac: add 802.11w management frame protection support

2016-03-07 14:15:59 +02:00

feature.h

brcmfmac: add 802.11w management frame protection support

2016-03-07 14:15:59 +02:00

firmware.c

brcmfmac: insert default boardrev in nvram data if missing

2016-04-14 15:57:47 +03:00

firmware.h

brcmfmac: fix BRCMF_FW_NVRAM_DEF macro for older gcc compilers

2016-01-18 11:20:52 -05:00

flowring.c

brcmfmac: Increase nr of supported flowrings.

2016-02-25 11:59:22 +02:00

flowring.h

brcmfmac: Increase nr of supported flowrings.

2016-02-25 11:59:22 +02:00

fweh.c

brcmfmac: delete interface directly in code that sent fw request

2016-07-08 16:45:47 +03:00

fweh.h

brcmfmac: Add length checks on firmware events

2016-03-07 14:14:45 +02:00

fwil_types.h

brcmfmac: add 802.11w management frame protection support

2016-03-07 14:15:59 +02:00

fwil.c

brcmfmac: Return actual error by fwil.

2015-11-30 14:46:38 +02:00

fwil.h

brcmfmac: add support for nl80211 BSS_SELECT feature

2016-04-26 12:14:27 +03:00

fwsignal.c

brcmfmac: restore stopping netdev queue when bus clogs up

2016-07-18 22:41:16 +03:00

fwsignal.h

brcmfmac: cleanup ampdu-rx host reorder code

2016-04-14 15:57:51 +03:00

Makefile

…

msgbuf.c

brcmfmac: add eth_type_trans back for PCIe full dongle

2016-06-03 11:17:45 +03:00

msgbuf.h

brcmfmac: Increase nr of supported flowrings.

2016-02-25 11:59:22 +02:00

of.c

brcmfmac: merge platform data and module paramaters

2016-03-07 14:15:56 +02:00

of.h

brcmfmac: merge platform data and module paramaters

2016-03-07 14:15:56 +02:00

p2p.c

brcmfmac: Check rtnl_lock is locked when removing interface

2016-08-24 16:13:47 +03:00

p2p.h

brcmfmac: Check rtnl_lock is locked when removing interface

2016-08-24 16:13:47 +03:00

pcie.c

brcmfmac: add support for the PCIE devices 43525 and 43465

2016-06-16 18:20:05 +03:00

pcie.h

…

proto.c

…

proto.h

brcmfmac: cleanup ampdu-rx host reorder code

2016-04-14 15:57:51 +03:00

sdio.c

brcmfmac: defer DPC processing during probe

2016-07-18 22:41:48 +03:00

sdio.h

brcmfmac: Fix 'did not remove int handler' warning

2016-06-04 17:58:52 +03:00

tracepoint.c

…

tracepoint.h

…

usb.c

brcm80211: correct speed testing

2016-05-03 15:49:34 -04:00

usb.h

…

vendor.c

…

vendor.h

…