linux-toradex.git/net/wireless/radiotap.c, branch v3.2.68

radiotap: fix bitmap-end-finding buffer overrun

2014-02-15T19:20:13+00:00

commit bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575 upstream.

Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.

Reported-by: Evan Huus 
Signed-off-by: Johannes Berg 
Signed-off-by: Ben Hutchings

wireless: radiotap: fix parsing buffer overrun

2013-11-28T14:02:04+00:00

commit f5563318ff1bde15b10e736e97ffce13be08bc1a upstream.

When parsing an invalid radiotap header, the parser can overrun
the buffer that is passed in because it doesn't correctly check
 1) the minimum radiotap header size
 2) the space for extended bitmaps

The first issue doesn't affect any in-kernel user as they all
check the minimum size before calling the radiotap function.
The second issue could potentially affect the kernel if an skb
is passed in that consists only of the radiotap header with a
lot of extended bitmaps that extend past the SKB. In that case
a read-only buffer overrun by at most 4 bytes is possible.

Fix this by adding the appropriate checks to the parser.

Reported-by: Evan Huus 
Signed-off-by: Johannes Berg 
Signed-off-by: Ben Hutchings

net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules

2011-10-31T23:30:30+00:00

These files are non modular, but need to export symbols using
the macros now living in export.h -- call out the include so
that things won't break when we remove the implicit presence
of module.h from everywhere.

Signed-off-by: Paul Gortmaker

radiotap: fix vendor namespace parsing

2010-10-15T19:57:34+00:00

There's a bug with radiotap vendor namespace
parsing if you don't register for the given
namespace extensions. Fix this by passing
only the unknown vendor namespaces and the
registered data to frontends, but not both.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

net/wireless: use ARRAY_SIZE macro in radiotap.c

2010-09-14T20:05:57+00:00

Replace sizeof(rtap_namespace_sizes) / sizeof(rtap_namespace_sizes[0])
with ARRAY_SIZE(rtap_namespace_sizes) in net/wireless/radiotap.c

Signed-off-by: Nikitas Angelinas 
Signed-off-by: John W. Linville

wireless: update radiotap parser

2010-02-08T21:50:53+00:00

Upstream radiotap has adopted the namespace
proposal David Young made and I then took care
of, for which I had adapted the radiotap parser
as a library outside the kernel. This brings
the in-kernel parser up to speed.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

wireless: use get/put_unaligned_* helpers

2008-05-14T20:29:32+00:00

Signed-off-by: Harvey Harrison 
Signed-off-by: John W. Linville

[WIRELESS] radiotap parser: accept all other fields

2007-10-10T23:47:43+00:00

This makes the radiotap parser accept all other fields that are
currently defined.

Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville

[PATCH] cfg80211: Radiotap parser

2007-07-12T20:07:24+00:00

Generic code to walk through the fields in a radiotap header, accounting
for nasties like extended "field present" bitfields and alignment rules

Signed-off-by: Andy Green 
Signed-off-by: Jiri Benc 
Signed-off-by: John W. Linville