nl80211: validate key indexes for cfg80211_registered_device

syzbot discovered a bug in which an OOB access was being made because
an unsuitable key_idx value was wrongly considered to be acceptable
while deleting a key in nl80211_del_key().

Since we don't know the cipher at the time of deletion, if
cfg80211_validate_key_settings() were to be called directly in
nl80211_del_key(), even valid keys would be wrongly determined invalid,
and deletion wouldn't occur correctly.
For this reason, a new function - cfg80211_valid_key_idx(), has been
created, to determine if the key_idx value provided is valid or not.
cfg80211_valid_key_idx() is directly called in 2 places -
nl80211_del_key(), and cfg80211_validate_key_settings().

Reported-by: [email protected]
Tested-by: [email protected]
Suggested-by: Johannes Berg <[email protected]>
Signed-off-by: Anant Thazhemadam <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Cc: [email protected]
[also disallow IGTK key IDs if no IGTK cipher is supported]
Signed-off-by: Johannes Berg <[email protected]>

0 files changed, 0 insertions, 0 deletions