From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-eopbgr680134.outbound.protection.outlook.com ([40.107.68.134]:2178 "EHLO NAM04-BN3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1731967AbeIXUy2 (ORCPT ); Mon, 24 Sep 2018 16:54:28 -0400 From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Arunk Khandavalli , Jouni Malinen , Johannes Berg , Sasha Levin Subject: [PATCH AUTOSEL 3.18 04/13] cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE Date: Mon, 24 Sep 2018 14:50:09 +0000 Message-ID: <20180924144959.164754-4-alexander.levin@microsoft.com> References: <20180924144959.164754-1-alexander.levin@microsoft.com> In-Reply-To: <20180924144959.164754-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Arunk Khandavalli [ Upstream commit 4f0223bfe9c3e62d8f45a85f1ef1b18a8a263ef9 ] nl80211_update_ft_ies() tried to validate NL80211_ATTR_IE with is_valid_ie_attr() before dereferencing it, but that helper function returns true in case of NULL pointer (i.e., attribute not included). This can result to dereferencing a NULL pointer. Fix that by explicitly checking that NL80211_ATTR_IE is included. Fixes: 355199e02b83 ("cfg80211: Extend support for IEEE 802.11r Fast BSS Tr= ansition") Signed-off-by: Arunk Khandavalli Signed-off-by: Jouni Malinen Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin --- net/wireless/nl80211.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index fefc9a4d3592..2e1633ac93f7 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -9223,6 +9223,7 @@ static int nl80211_update_ft_ies(struct sk_buff *skb,= struct genl_info *info) return -EOPNOTSUPP; =20 if (!info->attrs[NL80211_ATTR_MDID] || + !info->attrs[NL80211_ATTR_IE] || !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) return -EINVAL; =20 --=20 2.17.1