diff options
author | Yue Tao <Yue.Tao@windriver.com> | 2015-05-26 12:55:42 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2015-05-29 10:17:15 +0100 |
commit | 46bca1b82908a4bfca310b1d8d951c3331924c4d (patch) | |
tree | 435eaffaa59bf19bfe2b356409896980678efa98 /meta/recipes-connectivity/wpa-supplicant/wpa-supplicant | |
parent | 2d2d5e69776113aa6d8b4b3204d5bc70310d3858 (diff) | |
download | poky-46bca1b82908a4bfca310b1d8d951c3331924c4d.tar.gz |
wpa-supplicant: upgrade to 2.4
1. upgrade to 2.4
2. update the checksum, and license checksum since date in it is changed
3. Backport a patch to fix CVE-2015-1863
4. remove two deprecated patches
(From OE-Core rev: fd0880c2b0958b72d641a6821ddd6d6790a92b7a)
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-connectivity/wpa-supplicant/wpa-supplicant')
3 files changed, 47 insertions, 80 deletions
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch new file mode 100644 index 0000000000..e108a931c0 --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch | |||
@@ -0,0 +1,47 @@ | |||
1 | From 9ed4eee345f85e3025c33c6e20aa25696e341ccd Mon Sep 17 00:00:00 2001 | ||
2 | From: Jouni Malinen <jouni@qca.qualcomm.com> | ||
3 | Date: Tue, 7 Apr 2015 11:32:11 +0300 | ||
4 | Subject: [PATCH] P2P: Validate SSID element length before copying it | ||
5 | (CVE-2015-1863) | ||
6 | |||
7 | This fixes a possible memcpy overflow for P2P dev->oper_ssid in | ||
8 | p2p_add_device(). The length provided by the peer device (0..255 bytes) | ||
9 | was used without proper bounds checking and that could have resulted in | ||
10 | arbitrary data of up to 223 bytes being written beyond the end of the | ||
11 | dev->oper_ssid[] array (of which about 150 bytes would be beyond the | ||
12 | heap allocation) when processing a corrupted management frame for P2P | ||
13 | peer discovery purposes. | ||
14 | |||
15 | This could result in corrupted state in heap, unexpected program | ||
16 | behavior due to corrupted P2P peer device information, denial of service | ||
17 | due to process crash, exposure of memory contents during GO Negotiation, | ||
18 | and potentially arbitrary code execution. | ||
19 | |||
20 | Thanks to Google security team for reporting this issue and smart | ||
21 | hardware research group of Alibaba security team for discovering it. | ||
22 | |||
23 | Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> | ||
24 | |||
25 | Upstream-Status: Backport | ||
26 | |||
27 | Signed-off-by: Yue Tao <yue.tao@windriver.com> | ||
28 | |||
29 | --- | ||
30 | src/p2p/p2p.c | 1 + | ||
31 | 1 file changed, 1 insertion(+) | ||
32 | |||
33 | diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c | ||
34 | index f584fae..a45fe73 100644 | ||
35 | --- a/src/p2p/p2p.c | ||
36 | +++ b/src/p2p/p2p.c | ||
37 | @@ -778,6 +778,7 @@ int p2p_add_device(struct p2p_data *p2p, const u8 *addr, int freq, | ||
38 | if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0) | ||
39 | os_memcpy(dev->interface_addr, addr, ETH_ALEN); | ||
40 | if (msg.ssid && | ||
41 | + msg.ssid[1] <= sizeof(dev->oper_ssid) && | ||
42 | (msg.ssid[1] != P2P_WILDCARD_SSID_LEN || | ||
43 | os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) | ||
44 | != 0)) { | ||
45 | -- | ||
46 | 1.7.9.5 | ||
47 | |||
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-linux_wext-Fix-types-for-musl.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-linux_wext-Fix-types-for-musl.patch deleted file mode 100644 index 49a988b676..0000000000 --- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-linux_wext-Fix-types-for-musl.patch +++ /dev/null | |||
@@ -1,38 +0,0 @@ | |||
1 | From 159db445dc4cb0af5f6ad85f3a146ad137db5057 Mon Sep 17 00:00:00 2001 | ||
2 | From: Khem Raj <raj.khem@gmail.com> | ||
3 | Date: Fri, 3 Apr 2015 20:38:21 -0700 | ||
4 | Subject: [PATCH] linux_wext: Fix types for musl | ||
5 | |||
6 | | ../src/drivers/linux_wext.h:24:9: error: unknown type name '__uint32_t' | ||
7 | | typedef __uint32_t __u32; | ||
8 | |||
9 | Signed-off-by: Khem Raj <raj.khem@gmail.com> | ||
10 | Upstream-Status: Pending | ||
11 | --- | ||
12 | src/drivers/linux_wext.h | 10 +++++----- | ||
13 | 1 file changed, 5 insertions(+), 5 deletions(-) | ||
14 | |||
15 | diff --git a/src/drivers/linux_wext.h b/src/drivers/linux_wext.h | ||
16 | index 55cf955..e66df91 100644 | ||
17 | --- a/src/drivers/linux_wext.h | ||
18 | +++ b/src/drivers/linux_wext.h | ||
19 | @@ -21,11 +21,11 @@ | ||
20 | |||
21 | #include <sys/types.h> | ||
22 | #include <net/if.h> | ||
23 | -typedef __uint32_t __u32; | ||
24 | -typedef __int32_t __s32; | ||
25 | -typedef __uint16_t __u16; | ||
26 | -typedef __int16_t __s16; | ||
27 | -typedef __uint8_t __u8; | ||
28 | +typedef u_int32_t __u32; | ||
29 | +typedef int32_t __s32; | ||
30 | +typedef u_int16_t __u16; | ||
31 | +typedef int16_t __s16; | ||
32 | +typedef u_int8_t __u8; | ||
33 | #ifndef __user | ||
34 | #define __user | ||
35 | #endif /* __user */ | ||
36 | -- | ||
37 | 2.1.4 | ||
38 | |||
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/fix-libnl3-host-contamination.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/fix-libnl3-host-contamination.patch deleted file mode 100644 index e899c1655d..0000000000 --- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/fix-libnl3-host-contamination.patch +++ /dev/null | |||
@@ -1,42 +0,0 @@ | |||
1 | Upstream-Status: Pending | ||
2 | |||
3 | From 37d6b3dd5a737cd67468e4a58b372bddd924a7be Mon Sep 17 00:00:00 2001 | ||
4 | From: Andreas Oberritter <obi@opendreambox.org> | ||
5 | Date: Fri, 8 Mar 2013 22:55:19 +0100 | ||
6 | Subject: [PATCH] Revert "build: Use updated libnl3 header paths" | ||
7 | |||
8 | This reverts commit e7ecddf33a446072effbc85a27a078a8e582c89e. | ||
9 | --- | ||
10 | src/drivers/drivers.mak | 2 +- | ||
11 | src/drivers/drivers.mk | 2 +- | ||
12 | 2 files changed, 2 insertions(+), 2 deletions(-) | ||
13 | |||
14 | diff --git a/src/drivers/drivers.mak b/src/drivers/drivers.mak | ||
15 | index 68ff910..1f38f57 100644 | ||
16 | --- a/src/drivers/drivers.mak | ||
17 | +++ b/src/drivers/drivers.mak | ||
18 | @@ -35,7 +35,7 @@ NEED_RFKILL=y | ||
19 | ifdef CONFIG_LIBNL32 | ||
20 | DRV_LIBS += -lnl-3 | ||
21 | DRV_LIBS += -lnl-genl-3 | ||
22 | - DRV_CFLAGS += -DCONFIG_LIBNL20 -I/usr/include/libnl3 | ||
23 | + DRV_CFLAGS += -DCONFIG_LIBNL20 | ||
24 | ifdef CONFIG_LIBNL3_ROUTE | ||
25 | DRV_LIBS += -lnl-route-3 | ||
26 | DRV_CFLAGS += -DCONFIG_LIBNL3_ROUTE | ||
27 | diff --git a/src/drivers/drivers.mk b/src/drivers/drivers.mk | ||
28 | index db8561a..c93e88d 100644 | ||
29 | --- a/src/drivers/drivers.mk | ||
30 | +++ b/src/drivers/drivers.mk | ||
31 | @@ -30,7 +30,7 @@ NEED_RFKILL=y | ||
32 | ifdef CONFIG_LIBNL32 | ||
33 | DRV_LIBS += -lnl-3 | ||
34 | DRV_LIBS += -lnl-genl-3 | ||
35 | - DRV_CFLAGS += -DCONFIG_LIBNL20 -I/usr/include/libnl3 | ||
36 | + DRV_CFLAGS += -DCONFIG_LIBNL20 | ||
37 | ifdef CONFIG_LIBNL3_ROUTE | ||
38 | DRV_LIBS += -lnl-route-3 | ||
39 | DRV_CFLAGS += -DCONFIG_LIBNL3_ROUTE | ||
40 | -- | ||
41 | 1.7.10.4 | ||
42 | |||