Johannes Berg 42da2f948d wireless extensions: fix kernel heap content leak ... Wireless extensions have an unfortunate, undocumented requirement which requires drivers to always fill iwp->length when returning a successful status. When a driver doesn't do this, it leads to a kernel heap content leak when userspace offers a larger buffer than would have been necessary. Arguably, this is a driver bug, as it should, if it returns 0, fill iwp->length, even if it separately indicated that the buffer contents was not valid. However, we can also at least avoid the memory content leak if the driver doesn't do this by setting the iwp length to max_tokens, which then reflects how big the buffer is that the driver may fill, regardless of how big the userspace buffer is. To illustrate the point, this patch also fixes a corresponding cfg80211 bug (since this requirement isn't documented nor was ever pointed out by anyone during code review, I don't trust all drivers nor all cfg80211 handlers to implement it correctly). Cc: stable@kernel.org [all the way back] Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>		2010-08-30 16:35:17 -04:00
..
9p	fs/9p: destroy fid on failed remove	2010-08-02 14:28:36 -05:00
802	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2010-04-11 14:53:53 -07:00
8021q	vlan_dev: VLAN 0 should be treated as "no vlan tag" (802.1p packet)	2010-07-18 15:38:44 -07:00
appletalk	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2010-04-11 14:53:53 -07:00
atm	ppp: make channel_ops const	2010-08-04 21:53:17 -07:00
ax25	net: sk_sleep() helper	2010-04-20 16:37:13 -07:00
bluetooth	Bluetooth: Fix incorrect setting of remote_tx_win for L2CAP ERTM	2010-08-10 07:59:11 -04:00
bridge	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2010-08-02 22:22:46 -07:00
caif	caif: precedence bug	2010-07-22 14:14:47 -07:00
can	can-raw: Fix skb_orphan_try handling	2010-08-03 00:31:48 -07:00
core	net: disable preemption before call smp_processor_id()	2010-08-07 20:35:43 -07:00
dcb	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
dccp	net: dccp: fix sign bug	2010-07-18 15:07:14 -07:00
decnet	net-next: remove useless union keyword	2010-06-10 23:31:35 -07:00
dsa	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2010-07-20 18:25:24 -07:00
econet	econet: fix locking	2010-06-11 18:37:08 -07:00
ethernet	Net: ethernet: pe2.c: fix EXPORT_SYMBOL macro code style issue	2010-07-14 18:27:09 -07:00
ieee802154	ieee802154: Fix possible NULL pointer dereference in wpan_phy_alloc	2010-05-23 23:11:07 -07:00
ipv4	tcp: no md5sig option size check bug	2010-08-07 20:24:28 -07:00
ipv6	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2010-08-04 15:31:02 -07:00
ipx	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
irda	ppp: make channel_ops const	2010-08-04 21:53:17 -07:00
iucv	net: use __packed annotation	2010-06-03 03:21:52 -07:00
key	pfkey: add severity to printk	2010-05-17 23:23:13 -07:00
l2tp	ppp: make channel_ops const	2010-08-04 21:53:17 -07:00
lapb	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
llc	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2010-05-12 00:05:35 -07:00
mac80211	mac80211: delete work timer	2010-08-30 16:02:34 -04:00
netfilter	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2010-08-04 15:31:02 -07:00
netlabel	net: Remove unnecessary returns from void function()s	2010-05-17 23:23:14 -07:00
netlink	genetlink: use genl_register_family_with_ops()	2010-07-26 21:00:10 -07:00
netrom	net: sk_sleep() helper	2010-04-20 16:37:13 -07:00
packet	packet_mmap: expose hw packet timestamps to network packet capture utilities	2010-06-02 05:53:56 -07:00
phonet	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2010-07-20 18:25:24 -07:00
rds	net/rds: Add missing mutex_unlock	2010-05-29 00:18:48 -07:00
rfkill	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2010-04-11 14:53:53 -07:00
rose	net/rose: Use GFP_ATOMIC	2010-08-01 00:32:12 -07:00
rxrpc	RxRPC: Fix a potential deadlock between the call resend_timer and state_lock	2010-08-04 21:53:16 -07:00
sched	pkt_sched: Fix sch_sfq vs tcf_bind_filter oops	2010-08-07 22:45:41 -07:00
sctp	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2010-08-04 15:31:02 -07:00
sunrpc	mm: add context argument to shrinker callback to remaining shrinkers	2010-07-21 15:33:01 +10:00
tipc	tipc: Reduce footprint by un-inlining tipc_msg_* routines	2010-05-12 23:02:29 -07:00
unix	drop_monitor: convert some kfree_skb call sites to consume_skb	2010-07-20 13:28:05 -07:00
wanrouter	net: autoconvert trivial BKL users to private mutex	2010-07-12 20:21:47 -07:00
wimax	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6	2010-05-20 21:04:44 -07:00
wireless	wireless extensions: fix kernel heap content leak	2010-08-30 16:35:17 -04:00
x25	X25: Remove bkl in sockopts	2010-05-17 17:39:28 -07:00
xfrm	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2010-07-20 18:25:24 -07:00
compat.c	From abbffa2aa9bd6f8df16d0d0a102af677510d8b9a Mon Sep 17 00:00:00 2001	2010-06-03 20:03:40 -07:00
Kconfig	wireless: Make COMPAT_NETLINK_MESSAGES depend upon WEXT_CORE	2010-07-26 13:13:49 -07:00
Makefile	net/Makefile: conditionally descend to wireless and ieee802154	2010-06-29 15:32:43 -07:00
nonet.c
socket.c	net: support time stamping in phy devices.	2010-07-18 19:15:26 -07:00
sysctl_net.c	net: Remove unnecessary returns from void function()s	2010-05-17 23:23:14 -07:00
TUNABLE