kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/net
History
Pengpeng Hou d3a1fb2ca3 net/ipv6: ioam6: prevent schema length wraparound in trace fill 
[ Upstream commit 5e67ba9bb5 ]

ioam6_fill_trace_data() stores the schema contribution to the trace
length in a u8. With bit 22 enabled and the largest schema payload,
sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the
remaining-space check. __ioam6_fill_trace_data() then positions the
write cursor without reserving the schema area but still copies the
4-byte schema header and the full schema payload, overrunning the trace
buffer.

Keep sclen in an unsigned int so the remaining-space check and the write
cursor calculation both see the full schema length.

Fixes: 8c6f6fa677 ("ipv6: ioam: IOAM Generic Netlink API")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Justin Iurman <justin.iurman@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Li hongliang <1468888505@139.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-06-19 13:33:49 +02:00
..
6lowpan 6lowpan: fix off-by-one in multicast context address compression 2026-06-19 13:33:33 +02:00
9p use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
802 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr 2026-06-19 13:33:34 +02:00
8021q net: vlan: sync VLAN features with lower device 2025-12-07 06:09:26 +09:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:24:04 +02:00
atm atm: lec: fix use-after-free in sock_def_readable() 2026-04-18 10:33:29 +02:00
ax25 ax25: properly unshare skbs in ax25_kiss_rcv() 2025-09-09 18:50:20 +02:00
batman-adv batman-adv: tp_meter: fix tp_num leak on kmalloc failure 2026-06-19 13:33:49 +02:00
bluetooth Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() 2026-06-19 13:33:47 +02:00
bpf bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb 2026-06-01 17:35:29 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge net: bridge: use a stable FDB dst snapshot in RCU readers 2026-06-19 13:33:41 +02:00
caif net: caif: clear client service pointer on teardown 2026-06-01 17:35:14 +02:00
can can: raw: fix ro->uniq use-after-free in raw_rcv() 2026-06-01 17:35:04 +02:00
ceph use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
core net: skbuff: fix missing zerocopy reference in pskb_carve helpers 2026-06-19 13:33:47 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: free routing table on probe failure 2026-02-19 16:21:45 +01:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool ethtool: eeprom: add more safeties to EEPROM Netlink fallback 2026-06-19 13:33:24 +02:00
hsr net: hsr: defer node table free until after RCU readers 2026-06-19 13:33:46 +02:00
ieee802154 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() 2026-06-19 13:33:34 +02:00
ife net: sched: ife: fix potential use-after-free 2024-01-05 15:13:29 +01:00
ipv4 netfilter: nft_fib: fix stale stack leak via the OIFNAME register 2026-06-19 13:33:49 +02:00
ipv6 net/ipv6: ioam6: prevent schema length wraparound in trace fill 2026-06-19 13:33:49 +02:00
iucv net/iucv: fix locking in .getsockopt 2026-06-19 13:33:23 +02:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-09-04 13:23:32 +02:00
key xfrm: route MIGRATE notifications to caller's netns 2026-06-19 13:33:28 +02:00
l2tp l2tp: Drop large packets with UDP encap 2026-06-01 17:35:03 +02:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: fix data loss when reading from a socket in llc_ui_recvmsg() 2025-06-04 14:38:06 +02:00
mac80211 wifi: mac80211: check tdls flag in ieee80211_tdls_oper 2026-06-01 17:35:45 +02:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:16:00 +01:00
mctp net: mctp: fix don't require received header reserved bits to be zero 2026-06-19 13:33:41 +02:00
mpls mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). 2025-06-27 11:05:36 +01:00
mptcp mptcp: do not drop partial packets 2026-06-19 13:33:46 +02:00
ncsi net: ncsi: fix skb leak in error paths 2026-04-18 10:33:15 +02:00
netfilter ipvs: skip ipv6 extension headers for csum checks 2026-06-19 13:33:49 +02:00
netlabel netlabel: validate unlabeled address and mask attribute lengths 2026-06-19 13:33:35 +02:00
netlink genetlink: Use internal flags for multicast groups 2026-06-19 13:33:45 +02:00
netrom netrom: fix double-free in nr_route_frame() 2026-02-06 16:41:58 +01:00
nfc nfc: hci: fix out-of-bounds read in HCP header parsing 2026-06-19 13:33:28 +02:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch net: openvswitch: fix possible kfree_skb of ERR_PTR 2026-06-19 13:33:35 +02:00
packet net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() 2026-06-19 13:33:40 +02:00
phonet phonet/pep: disable BH around forwarded sk_receive_skb() 2026-06-01 17:35:46 +02:00
psample genetlink: Use internal flags for multicast groups 2026-06-19 13:33:45 +02:00
qrtr net: qrtr: ns: Limit the total number of nodes 2026-06-19 13:33:41 +02:00
rds net: rds: clear i_sends on setup unwind 2026-06-19 13:33:38 +02:00
rfkill net: rfkill: prevent unlimited numbers of rfkill events from being created 2026-04-18 10:33:38 +02:00
rose net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect 2026-04-18 10:33:20 +02:00
rxrpc rxrpc: Fix missing validation of ticket length in non-XDR key preparsing 2026-06-01 17:35:12 +02:00
sched net/sched: act_api: use RCU with deferred freeing for action lifecycle 2026-06-19 13:33:33 +02:00
sctp sctp: stream: fully roll back denied add-stream state 2026-06-19 13:33:38 +02:00
smc use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-06-01 17:35:14 +02:00
sunrpc use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
tls use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
unix af_unix: read UNIX_DIAG_VFS data under unix_state_lock 2026-06-01 17:35:03 +02:00
vmw_vsock vsock/vmci: fix sk_ack_backlog leak on failed handshake 2026-06-19 13:33:37 +02:00
wireless wifi: cfg80211: advance loop vars in cfg80211_merge_profile() 2026-06-01 17:35:47 +02:00
x25 net/x25: Fix overflow when accumulating packets 2026-04-18 10:33:31 +02:00
xdp xsk: tighten UMEM headroom validation to account for tailroom and min frame 2026-06-01 17:35:02 +02:00
xfrm use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
compat.c use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00