kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/net
History
Ilya Dryomov 145d140abd libceph: make decode_pool() more resilient against corrupted osdmaps 
commit 8c73851271 upstream.

If the osdmap is (maliciously) corrupted such that the encoded length
of ceph_pg_pool envelope is less than what is expected for a particular
encoding version, out-of-bounds reads may ensue because the only bounds
check that is there is based on that length value.

This patch adds explicit bounds checks for each field that is decoded
or skipped.

Cc: stable@vger.kernel.org
Reported-by: ziming zhang <ezrakiez@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Tested-by: ziming zhang <ezrakiez@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-01-19 13:09:52 +01:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-07-22 16:19:03 +02:00
9p net/9p: fix double req put in p9_fd_cancelled 2025-10-19 16:21:28 +02:00
802 net: 802: LLC+SNAP OID:PID lookup on start of skb data 2025-01-23 17:15:49 +01:00
8021q net: vlan: sync VLAN features with lower device 2025-12-07 06:09:26 +09:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:24:04 +02:00
atm net: atm: fix memory leak in atm_register_sysfs when device_register fail 2025-09-09 18:50:20 +02:00
ax25 ax25: properly unshare skbs in ax25_kiss_rcv() 2025-09-09 18:50:20 +02:00
batman-adv batman-adv: fix OOB read/write in network-coding decode 2025-09-09 18:50:21 +02:00
bluetooth Bluetooth: Add more enc key size check 2025-12-07 06:09:36 +09:00
bpf bpf: Set run context for rawtp test_run callback 2024-07-05 09:14:06 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge bridge: Redirect to backup port when port is administratively down 2025-12-07 06:09:19 +09:00
caif caif: fix integer underflow in cffrml_receive() 2026-01-19 13:09:44 +01:00
can can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails 2025-10-02 13:39:03 +02:00
ceph libceph: make decode_pool() more resilient against corrupted osdmaps 2026-01-19 13:09:52 +01:00
core net: netpoll: fix incorrect refcount handling causing incorrect cleanup 2025-12-07 06:09:32 +09:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx 2025-12-07 06:09:25 +09:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool ethtool: Avoid overflowing userspace buffer on stats query 2026-01-19 13:09:44 +01:00
hsr net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() 2026-01-19 13:09:46 +01:00
ieee802154 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() 2024-12-14 19:51:37 +01:00
ife net: sched: ife: fix potential use-after-free 2024-01-05 15:13:29 +01:00
ipv4 inet: Avoid ehash lookup race in inet_ehash_insert() 2026-01-19 13:09:23 +01:00
ipv6 xfrm: flush all states in xfrm_state_fini 2026-01-19 13:09:19 +01:00
iucv s390/iucv: fix receive buffer virtual vs physical address confusion 2024-09-04 13:23:27 +02:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-09-04 13:23:32 +02:00
key Revert "xfrm: destroy xfrm_state synchronously on net exit path" 2026-01-19 13:09:18 +01:00
l2tp genetlink: hold RCU in genlmsg_mcast() 2024-11-01 01:52:34 +01:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: fix data loss when reading from a socket in llc_ui_recvmsg() 2025-06-04 14:38:06 +02:00
mac80211 wifi: mac80211: skip rate verification for not captured PSDUs 2025-12-07 06:09:28 +09:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:16:00 +01:00
mctp net: mctp: Prevent duplicate binds 2025-08-28 16:24:20 +02:00
mpls mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). 2025-06-27 11:05:36 +01:00
mptcp mptcp: Fix proto fallback detection with BPF 2025-12-07 06:09:36 +09:00
ncsi net: ncsi: Fix buffer overflow in fetching version id 2025-08-28 16:24:22 +02:00
netfilter ipvs: fix ipv4 null-ptr-deref in route error path 2026-01-19 13:09:43 +01:00
netlabel calipso: unlock rcu before returning -EAFNOSUPPORT 2025-06-27 11:05:22 +01:00
netlink netlink: avoid infinite retry looping in netlink_unicast() 2025-08-28 16:24:15 +02:00
netrom netrom: Fix memory leak in nr_sendmsg() 2026-01-19 13:09:43 +01:00
nfc net: nfc: nci: Add parameter validation for packet data 2025-10-19 16:21:38 +02:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch net: openvswitch: fix middle attribute validation in push_nsh() action 2026-01-19 13:09:43 +01:00
packet net/packet: fix a race in packet_set_ring() and packet_notifier() 2025-08-28 16:24:14 +02:00
phonet phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() 2025-08-28 16:23:59 +02:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:36:37 +01:00
qrtr net: qrtr: Update packets cloning when broadcasting 2024-10-17 15:11:08 +02:00
rds rds: Fix endianness annotation for RDS_MPATH_HASH 2025-12-07 06:09:19 +09:00
rfkill net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer 2025-10-02 13:39:09 +02:00
rose rose: fix dangling neighbour pointers in rose_rt_device_down() 2025-07-10 15:57:46 +02:00
rxrpc rxrpc: Fix oops due to non-existence of prealloc backlog struct 2025-07-17 18:30:48 +02:00
sched net/sched: ets: Remove drr class from the active list if it changes to strict 2026-01-19 13:09:44 +01:00
sctp sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). 2026-01-19 13:09:24 +01:00
smc net/smc: fix mismatch between CLC header and proposal 2025-12-07 06:09:27 +09:00
strparser strparser: Fix signed/unsigned mismatch bug 2025-12-07 06:09:29 +09:00
sunrpc sunrpc: fix race in cache cleanup causing stale nextcheck time 2025-06-27 11:05:29 +01:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: Fix use-after-free in tipc_mon_reinit_self(). 2025-12-07 06:09:27 +09:00
tls net: tls: Cancel RX async resync request on rcd_delta overflow 2025-12-07 06:09:31 +09:00
unix af_unix: Don't leave consecutive consumed OOB skbs. 2025-10-02 13:39:14 +02:00
vmw_vsock vsock: Ignore signal/timeout on connect() if already established 2025-12-07 06:09:31 +09:00
wireless wifi: cfg80211: fix use-after-free in cmp_bss() 2025-09-09 18:50:18 +02:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-26 18:21:23 -04:00
xdp xsk: fix OOB map writes when deleting elements 2024-12-14 19:51:33 +01:00
xfrm xfrm: flush all states in xfrm_state_fini 2026-01-19 13:09:19 +01:00
compat.c net: Return the correct errno code 2021-06-03 15:13:56 -07:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c splice, net: Add a splice_eof op to file-ops and socket-ops 2025-10-29 14:03:08 +01:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00