Go to file
Johannes Berg e8e599a635 wifi: mac80211: fix potential key use-after-free
commit 31db78a4923ef5e2008f2eed321811ca79e7f71b upstream.

When ieee80211_key_link() is called by ieee80211_gtk_rekey_add()
but returns 0 due to KRACK protection (identical key reinstall),
ieee80211_gtk_rekey_add() will still return a pointer into the
key, in a potential use-after-free. This normally doesn't happen
since it's only called by iwlwifi in case of WoWLAN rekey offload
which has its own KRACK protection, but still better to fix, do
that by returning an error code and converting that to success on
the cfg80211 boundary only, leaving the error for bad callers of
ieee80211_gtk_rekey_add().

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Fixes: fdf7cb4185 ("mac80211: accept key reinstall without changing anything")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Sherry: bp to fix CVE-2023-52530, resolved minor conflicts in
  net/mac80211/cfg.c because of context change due to missing commit
  23a5f0af6ff4 ("wifi: mac80211: remove cipher scheme support")
  ccdde7c74ffd ("wifi: mac80211: properly implement MLO key handling")]
Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-10-22 15:39:24 +02:00
arch arm64: probes: Fix simulate_ldr*_literal() 2024-10-22 15:39:24 +02:00
block blk_iocost: fix more out of bound shifts 2024-10-17 15:08:10 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:13:17 +02:00
crypto crypto: aead,cipher - zeroize key buffer after use 2024-07-18 13:05:38 +02:00
Documentation arm64: errata: Expand speculative SSBS workaround once more 2024-10-17 15:08:26 +02:00
drivers irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 2024-10-22 15:39:24 +02:00
fs fat: fix uninitialized variable 2024-10-22 15:39:24 +02:00
include net: enetc: add missing static descriptor and inline keyword 2024-10-22 15:39:23 +02:00
init init/main.c: Fix potential static_command_line memory overflow 2024-05-02 16:23:39 +02:00
io_uring io_uring/io-wq: limit retrying worker initialisation 2024-08-19 05:41:03 +02:00
ipc ipc: replace costly bailout check in sysvipc_find_ipc() 2024-09-04 13:17:44 +02:00
kernel posix-clock: Fix missing timespec64 check in pc_clock_settime() 2024-10-22 15:39:23 +02:00
lib debugobjects: Fix conditions in fill_pool() 2024-10-17 15:08:02 +02:00
LICENSES LICENSES/deprecated: add Zlib license text 2020-09-16 14:33:49 +02:00
mm mm/swapfile: skip HugeTLB pages for unuse_vma 2024-10-22 15:39:24 +02:00
net wifi: mac80211: fix potential key use-after-free 2024-10-22 15:39:24 +02:00
samples Add gitignore file for samples/fanotify/ subdirectory 2024-08-19 05:41:21 +02:00
scripts kconfig: qconf: fix buffer overflow in debug links 2024-10-17 15:08:25 +02:00
security tomoyo: fallback to realpath if symlink's pathname does not exist 2024-10-17 15:08:24 +02:00
sound ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2 2024-10-22 15:39:23 +02:00
tools net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:08:35 +02:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2022-02-01 17:25:48 +01:00
virt KVM: Always flush async #PF workqueue when vCPU is being destroyed 2024-04-13 12:58:04 +02:00
.clang-format RDMA 5.10 pull request 2020-10-17 11:18:18 -07:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore Remove *.orig pattern from .gitignore 2024-10-17 15:07:59 +02:00
.mailmap mailmap: add two more addresses of Uwe Kleine-König 2020-12-06 10:19:07 -08:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Jason Cooper to CREDITS 2020-11-30 10:20:34 +01:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS Remove DECnet support from kernel 2023-06-21 15:45:38 +02:00
Makefile Linux 5.10.227 2024-10-17 15:08:39 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.