kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/net
History
Ido Schimmel cef33a86bc seg6: Fix validation of nexthop addresses 
[ Upstream commit 7632fedb26 ]

The kernel currently validates that the length of the provided nexthop
address does not exceed the specified length. This can lead to the
kernel reading uninitialized memory if user space provided a shorter
length than the specified one.

Fix by validating that the provided length exactly matches the specified
one.

Fixes: d1df6fd8a1 ("ipv6: sr: define core operations for seg6local lightweight tunnel")
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250604113252.371528-1-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-06-27 11:07:18 +01:00
..
6lowpan net: 6lowpan: constify lowpan_nhc structures 2022-06-09 21:53:28 +02:00
9p 9p/net: fix improper handling of bogus negative read/write replies 2025-05-02 07:47:04 +02:00
802 net: 802: LLC+SNAP OID:PID lookup on start of skb data 2025-01-17 13:34:38 +01:00
8021q net: vlan: don't propagate flags on open 2025-04-25 10:43:31 +02:00
appletalk appletalk: Fix Use-After-Free in atalk_ioctl 2023-12-20 17:00:19 +01:00
atm atm: Fix NULL pointer dereference 2025-04-07 10:05:45 +02:00
ax25 ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt 2025-02-21 13:49:56 +01:00
batman-adv batman-adv: Ignore own maximum aggregation size during RX 2025-03-28 21:59:01 +01:00
bluetooth Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION 2025-06-27 11:07:17 +01:00
bpf bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() 2025-03-07 16:56:37 +01:00
bpfilter uaccess: remove CONFIG_SET_FS 2022-02-25 09:36:06 +01:00
bridge netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it 2025-06-27 11:07:10 +01:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:50:24 +01:00
can can: bcm: add missing rcu read protection for procfs content 2025-06-04 14:40:20 +02:00
ceph libceph: fix race between delayed_work() and ceph_monc_stop() 2024-07-18 13:18:41 +02:00
core bpf, sockmap: Avoid using sk_socket after free when sending 2025-06-27 11:07:12 +01:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 12:08:17 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:17:17 +01:00
devlink devlink: bump the instance index directly when iterating 2024-10-22 15:56:43 +02:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 15:27:38 -08:00
dsa net: dsa: tag_brcm: legacy: fix pskb_may_pull length 2025-06-27 11:07:17 +01:00
ethernet ethernet: Add helper for assigning packet type when dest address does not match device address 2024-05-02 16:29:29 +02:00
ethtool net: ethtool: Don't call .cleanup_data when prepare_data fails 2025-04-25 10:43:25 +02:00
hsr net: hsr: fix fill_frame_info() regression vs VLAN packets 2025-02-21 13:49:23 +01:00
ieee802154 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() 2024-12-14 19:54:41 +01:00
ife net: sched: ife: fix potential use-after-free 2024-01-01 12:38:56 +00:00
ipv4 net: fix udp gso skb_segment after pull from frag_list 2025-06-27 11:07:18 +01:00
ipv6 seg6: Fix validation of nexthop addresses 2025-06-27 11:07:18 +01:00
iucv s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() 2024-12-14 19:53:50 +01:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-08-29 17:30:44 +02:00
key net: af_key: fix sadb_x_filter validation 2023-08-23 17:52:32 +02:00
l2tp genetlink: hold RCU in genlmsg_mcast() 2024-11-01 01:56:00 +01:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-15 14:27:24 -07:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: fix data loss when reading from a socket in llc_ui_recvmsg() 2025-06-04 14:40:21 +02:00
mac80211 wifi: mac80211: remove misplaced drv_mgd_complete_tx() call 2025-06-04 14:40:15 +02:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:17:11 +01:00
mctp net: mctp: Ensure keys maintain only one ref to corresponding dev 2025-05-22 14:10:02 +02:00
mpls net: mpls: error out if inner headers are not set 2024-04-13 13:05:27 +02:00
mptcp mptcp: sockopt: fix getting freebind & transparent 2025-04-25 10:44:00 +02:00
ncsi net: ncsi: Fix GCPS 64-bit member variables 2025-06-27 11:07:09 +01:00
netfilter netfilter: nf_set_pipapo_avx2: fix initial map fill 2025-06-27 11:07:18 +01:00
netlabel calipso: Don't call calipso functions for AF_INET sk. 2025-06-27 11:07:12 +01:00
netlink sock_diag: add module pointer to "struct sock_diag_handler" 2024-12-14 19:53:32 +01:00
netrom netrom: check buffer length before accessing it 2025-01-09 13:30:01 +01:00
nfc NFC: nci: Add bounds checking in nci_hci_create_pipe() 2025-02-21 13:49:51 +01:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:55:59 +02:00
openvswitch net: openvswitch: Fix the dead loop of MPLS parse 2025-06-27 11:07:12 +01:00
packet af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK 2025-01-09 13:30:02 +01:00
phonet phonet: fix rtm_phonet_notify() skb allocation 2024-05-17 11:56:12 +02:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:39:11 +01:00
qrtr net: qrtr: Update packets cloning when broadcasting 2024-10-17 15:21:13 +02:00
rds net:rds: Fix possible deadlock in rds_message_put 2024-08-29 17:30:20 +02:00
rfkill net: rfkill: gpio: Add check for clk_enable() 2024-12-14 19:53:33 +01:00
rose net: rose: lock the socket in rose_bind() 2025-02-21 13:49:37 +01:00
rxrpc rxrpc: Improve setsockopt() handling of malformed user input 2024-12-14 19:53:52 +01:00
sched net_sched: hfsc: Address reentrant enqueue adding class to eltree twice 2025-06-04 14:40:25 +02:00
sctp sctp: add mutual exclusion in proc_sctp_do_udp_port() 2025-05-22 14:10:09 +02:00
smc net/smc: use the correct ndev to find pnetid by pnetid table 2025-06-04 14:40:06 +02:00
strparser strparser: Add read_sock callback 2025-03-07 16:56:37 +01:00
sunrpc SUNRPC: rpcbind should never reset the port to the value '0' 2025-06-04 14:40:03 +02:00
switchdev net: switchdev: Convert blocking notification chain to a raw one 2025-03-28 21:58:49 +01:00
tipc net: tipc: fix refcount warning in tipc_aead_encrypt 2025-06-27 11:07:17 +01:00
tls ktls, sockmap: Fix missing uncharge operation 2025-06-27 11:07:11 +01:00
unix af_unix: Fix uninit-value in __unix_walk_scc() 2025-06-04 14:40:25 +02:00
vmw_vsock vsock: avoid timeout during connect() if the socket is closing 2025-04-10 14:33:40 +02:00
wireless wifi: cfg80211: cancel wiphy_work before freeing wiphy 2025-03-28 21:58:48 +01:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-26 18:20:42 -04:00
xdp xsk: fix an integer overflow in xp_create_and_assign_umem() 2025-03-28 21:59:01 +01:00
xfrm xfrm: Sanitize marks before insert 2025-06-04 14:40:19 +02:00
compat.c use less confusing names for iov_iter direction initializers 2023-02-09 11:28:04 +01:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2022-08-22 14:26:30 +01:00
Kconfig.debug net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET 2022-09-20 14:23:56 -07:00
Makefile af_unix: Remove CONFIG_UNIX_SCM. 2025-06-04 14:40:23 +02:00
socket.c net: explicitly clear the sk pointer, when pf->create fails 2024-10-17 15:22:27 +02:00
sysctl_net.c sysctl: treewide: drop unused argument ctl_table_root::set_ownership(table) 2024-08-11 12:35:51 +02:00