Johannes Berg 39968a6d1b wifi: cfg80211: reject HTC bit for management frames ...

[ Upstream commit be06a8c731 ]

Management frames sent by userspace should never have the
order/HTC bit set, reject that. It could also cause some
confusion with the length of the buffer and the header so
the validation might end up wrong.

Link: https://patch.msgid.link/20250718202307.97a0455f0f35.I1805355c7e331352df16611839bc8198c855a33f@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-08-28 16:24:20 +02:00

..

6lowpan

…

9p

…

802

net: 802: LLC+SNAP OID:PID lookup on start of skb data

2025-01-23 17:15:49 +01:00

8021q

net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime

2025-08-28 16:24:02 +02:00

appletalk

net: appletalk: Fix use-after-free in AARP proxy probe

2025-08-28 16:24:04 +02:00

atm

atm: clip: Fix NULL pointer dereference in vcc_sendmsg()

2025-07-17 18:30:47 +02:00

ax25

…

batman-adv

batman-adv: Ignore own maximum aggregation size during RX

2025-04-10 14:31:55 +02:00

bluetooth

Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU

2025-08-28 16:24:02 +02:00

bpf

…

bpfilter

…

bridge

net: bridge: Do not offload IGMP/MLD messages

2025-08-28 16:24:02 +02:00

caif

caif: reduce stack size, again

2025-08-28 16:24:07 +02:00

can

can: bcm: add missing rcu read protection for procfs content

2025-06-04 14:38:06 +02:00

ceph

…

core

netpoll: prevent hanging NAPI when netcons gets enabled

2025-08-28 16:24:13 +02:00

dcb

…

dccp

net: fix data-races around sk->sk_forward_alloc

2025-01-23 17:16:04 +01:00

dns_resolver

…

dsa

net: dsa: tag_brcm: legacy: fix pskb_may_pull length

2025-06-27 11:05:17 +01:00

ethernet

…

ethtool

net: ethtool: Don't call .cleanup_data when prepare_data fails

2025-05-02 07:43:52 +02:00

hsr

net: hsr: fix fill_frame_info() regression vs VLAN packets

2025-03-13 12:50:13 +01:00

ieee802154

net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()

2024-12-14 19:51:37 +01:00

ife

…

ipv4

udp: also consider secpath when evaluating ipsec use for checksumming

2025-08-28 16:24:16 +02:00

ipv6

ipv6: reject malicious packets in ipv6_gso_segment()

2025-08-28 16:24:13 +02:00

iucv

…

kcm

…

key

…

l2tp

…

l3mdev

…

lapb

…

llc

llc: fix data loss when reading from a socket in llc_ui_recvmsg()

2025-06-04 14:38:06 +02:00

mac80211

Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"

2025-08-28 16:24:08 +02:00

mac802154

mac802154: check local interfaces before deleting sdata list

2025-01-23 17:16:00 +01:00

mctp

net: mctp: Set SOCK_RCU_FREE

2025-05-02 07:44:10 +02:00

mpls

mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().

2025-06-27 11:05:36 +01:00

mptcp

net: make sock_inuse_add() available

2025-05-02 07:44:20 +02:00

ncsi

net: ncsi: Fix GCPS 64-bit member variables

2025-06-27 11:05:12 +01:00

netfilter

netfilter: ctnetlink: fix refcount leak on table dump

2025-08-28 16:24:16 +02:00

netlabel

calipso: unlock rcu before returning -EAFNOSUPPORT

2025-06-27 11:05:22 +01:00

netlink

netlink: avoid infinite retry looping in netlink_unicast()

2025-08-28 16:24:15 +02:00

netrom

netrom: check buffer length before accessing it

2025-01-09 13:28:46 +01:00

nfc

NFC: nci: uart: Set tty->disc_data only in success path

2025-06-27 11:05:25 +01:00

nsh

…

openvswitch

net: openvswitch: Fix the dead loop of MPLS parse

2025-06-27 11:05:14 +01:00

packet

net/packet: fix a race in packet_set_ring() and packet_notifier()

2025-08-28 16:24:14 +02:00

phonet

phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()

2025-08-28 16:23:59 +02:00

psample

…

qrtr

…

rds

…

rfkill

…

rose

rose: fix dangling neighbour pointers in rose_rt_device_down()

2025-07-10 15:57:46 +02:00

rxrpc

rxrpc: Fix oops due to non-existence of prealloc backlog struct

2025-07-17 18:30:48 +02:00

sched

net_sched: act_ctinfo: use atomic64_t for three counters

2025-08-28 16:24:08 +02:00

sctp

sctp: linearize cloned gso packets in sctp_rcv

2025-08-28 16:24:16 +02:00

smc

net/smc: fix data error when recvmsg with MSG_PEEK flag

2025-03-13 12:49:57 +01:00

strparser

…

sunrpc

sunrpc: fix race in cache cleanup causing stale nextcheck time

2025-06-27 11:05:29 +01:00

switchdev

…

tipc

tipc: Fix use-after-free in tipc_conn_close().

2025-07-17 18:30:46 +02:00

tls

bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls

2025-08-28 16:24:07 +02:00

unix

af_unix: Don't set -ECONNRESET for consumed OOB skb.

2025-07-10 15:57:38 +02:00

vmw_vsock

vsock: Do not allow binding to VMADDR_PORT_ANY

2025-08-28 16:24:14 +02:00

wireless

wifi: cfg80211: reject HTC bit for management frames

2025-08-28 16:24:20 +02:00

x25

…

xdp

xsk: fix OOB map writes when deleting elements

2024-12-14 19:51:33 +01:00

xfrm

xfrm: Sanitize marks before insert

2025-06-04 14:38:05 +02:00

compat.c

…

devres.c

…

Kconfig

…

Makefile

…

socket.c

…

sysctl_net.c

…