rpms/kernel
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Linux v4.13.5

Browse Source 
Fix for peaq_wmi nul spew (rhbz 1497861)
This commit is contained in:
Laura Abbott 2017-10-05 09:05:43 -07:00
parent 5202ffd4a6
commit 2bd4c79775
25 changed files with 47 additions and 224 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

88
KEYS-prevent-KEYCTL_READ-on-negative-key.patch
View File

@ -1,88 +0,0 @@
From patchwork Mon Sep 18 18:37:23 2017
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: KEYS: prevent KEYCTL_READ on negative key
From: Eric Biggers <ebiggers3@gmail.com>
X-Patchwork-Id: 9957387
Message-Id: <20170918183723.114253-1-ebiggers3@gmail.com>
To: keyrings@vger.kernel.org
Cc: David Howells <dhowells@redhat.com>, Michael Halcrow <mhalcrow@google.com>,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org, Eric Biggers <ebiggers@google.com>,
stable@vger.kernel.org
Date: Mon, 18 Sep 2017 11:37:23 -0700
From: Eric Biggers <ebiggers@google.com>
Because keyctl_read_key() looks up the key with no permissions
requested, it may find a negatively instantiated key. If the key is
also possessed, we went ahead and called ->read() on the key. But the
key payload will actually contain the ->reject_error rather than the
normal payload. Thus, the kernel oopses trying to read the
user_key_payload from memory address (int)-ENOKEY = 0x00000000ffffff82.
Fortunately the payload data is stored inline, so it shouldn't be
possible to abuse this as an arbitrary memory read primitive...
Reproducer:
keyctl new_session
keyctl request2 user desc '' @s
keyctl read $(keyctl show | awk '/user: desc/ {print $1}')
It causes a crash like the following:
BUG: unable to handle kernel paging request at 00000000ffffff92
IP: user_read+0x33/0xa0
PGD 36a54067 P4D 36a54067 PUD 0
Oops: 0000 [#1] SMP
CPU: 0 PID: 211 Comm: keyctl Not tainted 4.14.0-rc1 #337
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-20170228_101828-anatol 04/01/2014
task: ffff90aa3b74c3c0 task.stack: ffff9878c0478000
RIP: 0010:user_read+0x33/0xa0
RSP: 0018:ffff9878c047bee8 EFLAGS: 00010246
RAX: 0000000000000001 RBX: ffff90aa3d7da340 RCX: 0000000000000017
RDX: 0000000000000000 RSI: 00000000ffffff82 RDI: ffff90aa3d7da340
RBP: ffff9878c047bf00 R08: 00000024f95da94f R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f58ece69740(0000) GS:ffff90aa3e200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000ffffff92 CR3: 0000000036adc001 CR4: 00000000003606f0
Call Trace:
keyctl_read_key+0xac/0xe0
SyS_keyctl+0x99/0x120
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x7f58ec787bb9
RSP: 002b:00007ffc8d401678 EFLAGS: 00000206 ORIG_RAX: 00000000000000fa
RAX: ffffffffffffffda RBX: 00007ffc8d402800 RCX: 00007f58ec787bb9
RDX: 0000000000000000 RSI: 00000000174a63ac RDI: 000000000000000b
RBP: 0000000000000004 R08: 00007ffc8d402809 R09: 0000000000000020
R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffc8d402800
R13: 00007ffc8d4016e0 R14: 0000000000000000 R15: 0000000000000000
Code: e5 41 55 49 89 f5 41 54 49 89 d4 53 48 89 fb e8 a4 b4 ad ff 85 c0 74 09 80 3d b9 4c 96 00 00 74 43 48 8b b3 20 01 00 00 4d 85 ed <0f> b7 5e 10 74 29 4d 85 e4 74 24 4c 39 e3 4c 89 e2 4c 89 ef 48
RIP: user_read+0x33/0xa0 RSP: ffff9878c047bee8
CR2: 00000000ffffff92
Fixes: 61ea0c0ba904 ("KEYS: Skip key state checks when checking for possession")
Cc: <stable@vger.kernel.org> [v3.13+]
Signed-off-by: Eric Biggers <ebiggers@google.com>
---
security/keys/keyctl.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index ab0b337c84b4..6a82090c7fc1 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -766,6 +766,11 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
key = key_ref_to_ptr(key_ref);
+ if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
+ ret = -ENOKEY;
+ goto error2;
+ }
+
/* see if we can read it directly */
ret = key_permission(key_ref, KEY_NEED_READ);
if (ret == 0)

2
baseconfig/CONFIG_CRYPTO_GCM
View File

@ -1 +1 @@
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y

2
baseconfig/CONFIG_CRYPTO_GHASH
View File

@ -1 +1 @@
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y

4
kernel-aarch64-debug.config
View File

@ -1010,11 +1010,11 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH_ARM64_CE=m
CONFIG_CRYPTO_GHASH_ARM_CE=m
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-aarch64.config
View File

@ -1009,11 +1009,11 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH_ARM64_CE=m
CONFIG_CRYPTO_GHASH_ARM_CE=m
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-armv7hl-debug.config
View File

@ -1064,10 +1064,10 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH_ARM_CE=m
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-armv7hl-lpae-debug.config
View File

@ -1012,10 +1012,10 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH_ARM_CE=m
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-armv7hl-lpae.config
View File

@ -1010,10 +1010,10 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH_ARM_CE=m
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-armv7hl.config
View File

@ -1062,10 +1062,10 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH_ARM_CE=m
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-i686-PAE.config
View File

@ -870,9 +870,9 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-i686-PAEdebug.config
View File

@ -872,9 +872,9 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-i686-debug.config
View File

@ -872,9 +872,9 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-i686.config
View File

@ -870,9 +870,9 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-ppc64-debug.config
View File

@ -852,9 +852,9 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-ppc64.config
View File

@ -850,9 +850,9 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-ppc64le-debug.config
View File

@ -806,9 +806,9 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-ppc64le.config
View File

@ -804,9 +804,9 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-s390x-debug.config
View File

@ -797,10 +797,10 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH_S390=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-s390x.config
View File

@ -795,10 +795,10 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH_S390=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-x86_64-debug.config
View File

@ -896,10 +896,10 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL=m
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

4
kernel-x86_64.config
View File

@ -894,10 +894,10 @@ CONFIG_CRYPTO_ECDH=m
CONFIG_CRYPTO_ECHAINIV=m
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL=m
CONFIG_CRYPTO_GHASH=m
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_KEYWRAP=m

18
kernel.spec
View File

@ -54,7 +54,7 @@ Summary: The Linux kernel
%if 0%{?released_kernel}
# Do we have a -stable update to apply?
%define stable_update 4
%define stable_update 5
# Set rpm version accordingly
%if 0%{?stable_update}
%define stablerev %{stable_update}
@ -655,12 +655,6 @@ Patch617: Fix-for-module-sig-verification.patch
# rhbz 1485086
Patch619: pci-mark-amd-stoney-gpu-ats-as-broken.patch
# CVE-2017-12154 rhbz 1491224 1491231
Patch620: kvm-nVMX-Don-t-allow-L2-to-access-the-hardware-CR8.patch
# CVE-2017-12153 rhbz 1491046 1491057
Patch621: nl80211-check-for-the-required-netlink-attributes-presence.patch
# Should fix our QXL issues
Patch622: qxl-fixes.patch
@ -668,14 +662,14 @@ Patch622: qxl-fixes.patch
Patch623: HID-rmi-Make-sure-the-HID-device-is-opened-on-resume.patch
Patch624: input-rmi4-remove-the-need-for-artifical-IRQ.patch
# rhbz 1493435 1493436
Patch625: KEYS-prevent-KEYCTL_READ-on-negative-key.patch
# rhbz 1432684
Patch626: 1-3-net-set-tb--fast_sk_family.patch
Patch627: 2-3-net-use-inet6_rcv_saddr-to-compare-sockets.patch
Patch628: 3-3-inet-fix-improper-empty-comparison.patch
# rhbz 1497861
Patch629: 0001-platform-x86-peaq-wmi-Add-DMI-check-before-binding-t.patch
# END OF PATCH DEFINITIONS
%endif
@ -2230,6 +2224,10 @@ fi
#
#
%changelog
* Thu Oct 05 2017 Laura Abbott <labbott@fedoraproject.org> - 4.13.5-300
- Linux v4.13.5
- Fix for peaq_wmi nul spew (rhbz 1497861)
* Thu Sep 28 2017 Laura Abbott <labbott@redhat.com> - 4.13.4-300
- Linux v4.13.4

41
kvm-nVMX-Don-t-allow-L2-to-access-the-hardware-CR8.patch
View File

@ -1,41 +0,0 @@
From patchwork Tue Sep 12 20:02:54 2017
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: kvm: nVMX: Don't allow L2 to access the hardware CR8
From: Jim Mattson <jmattson@google.com>
X-Patchwork-Id: 9950035
Message-Id: <20170912200254.111560-1-jmattson@google.com>
To: kvm@vger.kernel.org, P J P <ppandit@redhat.com>,
Paolo Bonzini <pbonzini@redhat.com>
Cc: Jim Mattson <jmattson@google.com>
Date: Tue, 12 Sep 2017 13:02:54 -0700
If L1 does not specify the "use TPR shadow" VM-execution control in
vmcs12, then L0 must specify the "CR8-load exiting" and "CR8-store
exiting" VM-execution controls in vmcs02. Failure to do so will give
the L2 VM unrestricted read/write access to the hardware CR8.
This fixes CVE-2017-12154.
Signed-off-by: Jim Mattson <jmattson@google.com>
---
arch/x86/kvm/vmx.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index c6efc1f88b25..885b7eed4320 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -10525,6 +10525,11 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
if (exec_control & CPU_BASED_TPR_SHADOW) {
vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, -1ull);
vmcs_write32(TPR_THRESHOLD, vmcs12->tpr_threshold);
+ } else {
+#ifdef CONFIG_X86_64
+ exec_control |= CPU_BASED_CR8_LOAD_EXITING |
+ CPU_BASED_CR8_STORE_EXITING;
+#endif
}
/*

46
nl80211-check-for-the-required-netlink-attributes-presence.patch
View File

@ -1,46 +0,0 @@
From patchwork Tue Sep 12 22:21:21 2017
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: nl80211: check for the required netlink attributes presence
From: Vladis Dronov <vdronov@redhat.com>
X-Patchwork-Id: 9950281
Message-Id: <20170912222121.5032-1-vdronov@redhat.com>
To: Johannes Berg <johannes.berg@intel.com>,
Johannes Berg <johannes@sipsolutions.net>,
linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: Vladis Dronov <vdronov@redhat.com>, "# v3 . 1-rc1" <stable@vger.kernel.org>
Date: Wed, 13 Sep 2017 00:21:21 +0200
nl80211_set_rekey_data() does not check if the required attributes
NL80211_REKEY_DATA_{REPLAY_CTR,KEK,KCK} are present when processing
NL80211_CMD_SET_REKEY_OFFLOAD request. This request can be issued by
users with CAP_NET_ADMIN privilege and may result in NULL dereference
and a system crash. Add a check for the required attributes presence.
This patch is based on the patch by bo Zhang.
This fixes CVE-2017-12153.
References: https://bugzilla.redhat.com/show_bug.cgi?id=1491046
Fixes: e5497d766ad ("cfg80211/nl80211: support GTK rekey offload")
Cc: <stable@vger.kernel.org> # v3.1-rc1
Reported-by: bo Zhang <zhangbo5891001@gmail.com>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
---
net/wireless/nl80211.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 0df8023..fbd5593 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -10903,6 +10903,9 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
if (err)
return err;
+ if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
+ !tb[NL80211_REKEY_DATA_KCK])
+ return -EINVAL;
if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
return -ERANGE;
if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)

2
sources
View File

@ -1,3 +1,3 @@
SHA512 (linux-4.13.tar.xz) = a557c2f0303ae618910b7106ff63d9978afddf470f03cb72aa748213e099a0ecd5f3119aea6cbd7b61df30ca6ef3ec57044d524b7babbaabddf8b08b8bafa7d2
SHA512 (perf-man-4.13.tar.gz) = 9bcc2cd8e56ec583ed2d8e0b0c88e7a94035a1915e40b3177bb02d6c0f10ddd4df9b097b1f5af59efc624226b613e240ddba8ddc2156f3682f992d5455fc5c03
SHA512 (patch-4.13.4.xz) = 37aa8add92ae23b627c166b878b6d8191b75c2aca3a2eb2d7ae4f55262644731ab51a3ee171186fc0b011c6c8e537686377c3e73e8928797323b0a958eeb4b6b
SHA512 (patch-4.13.5.xz) = de55b07e52e88e3bc5af54c619933a81f535393f20712f38000bffa77ded22c7a16e70e43c28daf576bcc6cd3ad39387b8e1f430e3d22222f572113d2345df48