kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/net
History
Michael Thalmeier a24a8a582d net: nfc: nci: Fix parameter validation for packet data 
[ Upstream commit 571dcbeb8e ]

Since commit 9c328f5474 ("net: nfc: nci: Add parameter validation for
packet data") communication with nci nfc chips is not working any more.

The mentioned commit tries to fix access of uninitialized data, but
failed to understand that in some cases the data packet is of variable
length and can therefore not be compared to the maximum packet length
given by the sizeof(struct).

Fixes: 9c328f5474 ("net: nfc: nci: Add parameter validation for packet data")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Thalmeier <michael.thalmeier@hale.at>
Reported-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com
Link: https://patch.msgid.link/20260218083000.301354-1-michael.thalmeier@hale.at
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-03-04 07:20:37 -05:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-07-22 16:19:03 +02:00
9p net/9p: fix double req put in p9_fd_cancelled 2025-10-19 16:21:28 +02:00
802 net: 802: LLC+SNAP OID:PID lookup on start of skb data 2025-01-23 17:15:49 +01:00
8021q net: vlan: sync VLAN features with lower device 2025-12-07 06:09:26 +09:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:24:04 +02:00
atm net: atm: fix crash due to unvalidated vcc pointer in sigd_send() 2026-03-04 07:19:38 -05:00
ax25 ax25: properly unshare skbs in ax25_kiss_rcv() 2025-09-09 18:50:20 +02:00
batman-adv batman-adv: fix OOB read/write in network-coding decode 2025-09-09 18:50:21 +02:00
bluetooth Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ 2026-03-04 07:20:23 -05:00
bpf bpf: Do not let BPF test infra emit invalid GSO types to stack 2026-02-06 16:41:58 +01:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge netfilter: replace -EEXIST with -EBUSY 2026-02-11 13:35:30 +01:00
caif caif: fix integer underflow in cffrml_receive() 2026-01-19 13:09:44 +01:00
can net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts 2026-02-06 16:41:47 +01:00
ceph libceph: define and enforce CEPH_MAX_KEY_LEN 2026-03-04 07:20:19 -05:00
core net: consume xmit errors of GSO frames 2026-03-04 07:20:24 -05:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: free routing table on probe failure 2026-02-19 16:21:45 +01:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool ethtool: add support to set/get tx copybreak buf size via ethtool 2026-03-04 07:19:36 -05:00
hsr net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() 2026-01-19 13:09:46 +01:00
ieee802154 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() 2024-12-14 19:51:37 +01:00
ife net: sched: ife: fix potential use-after-free 2024-01-05 15:13:29 +01:00
ipv4 ipv4: fib: Annotate access to struct fib_alias.fa_state. 2026-03-04 07:20:10 -05:00
ipv6 ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() 2026-03-04 07:20:36 -05:00
iucv s390/iucv: fix receive buffer virtual vs physical address confusion 2024-09-04 13:23:27 +02:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-09-04 13:23:32 +02:00
key Revert "xfrm: destroy xfrm_state synchronously on net exit path" 2026-01-19 13:09:18 +01:00
l2tp l2tp: avoid one data-race in l2tp_tunnel_del_work() 2026-02-06 16:41:53 +01:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: fix data loss when reading from a socket in llc_ui_recvmsg() 2025-06-04 14:38:06 +02:00
mac80211 wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice 2026-02-11 13:35:31 +01:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:16:00 +01:00
mctp net: mctp: Prevent duplicate binds 2025-08-28 16:24:20 +02:00
mpls mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). 2025-06-27 11:05:36 +01:00
mptcp mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() 2026-02-19 16:21:45 +01:00
ncsi net: ncsi: Fix buffer overflow in fetching version id 2025-08-28 16:24:22 +02:00
netfilter netfilter: nf_conntrack_h323: fix OOB read in decode_choice() 2026-03-04 07:20:25 -05:00
netlabel calipso: unlock rcu before returning -EAFNOSUPPORT 2025-06-27 11:05:22 +01:00
netlink netlink: avoid infinite retry looping in netlink_unicast() 2025-08-28 16:24:15 +02:00
netrom netrom: fix double-free in nr_route_frame() 2026-02-06 16:41:58 +01:00
nfc net: nfc: nci: Fix parameter validation for packet data 2026-03-04 07:20:37 -05:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch net: openvswitch: Avoid needlessly taking the RTNL on vport destroy 2026-01-19 13:09:56 +01:00
packet net/packet: fix a race in packet_set_ring() and packet_notifier() 2025-08-28 16:24:14 +02:00
phonet phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() 2025-08-28 16:23:59 +02:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:36:37 +01:00
qrtr net: qrtr: Update packets cloning when broadcasting 2024-10-17 15:11:08 +02:00
rds net/rds: Clear reconnect pending bit 2026-03-04 07:20:11 -05:00
rfkill net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer 2025-10-02 13:39:09 +02:00
rose net: rose: fix invalid array index in rose_kill_by_device() 2026-01-19 13:09:58 +01:00
rxrpc rxrpc: Fix oops due to non-existence of prealloc backlog struct 2025-07-17 18:30:48 +02:00
sched net/sched: act_ife: convert comma to semicolon 2026-02-06 16:42:05 +01:00
sctp sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT 2026-02-06 16:41:52 +01:00
smc net/smc: fix mismatch between CLC header and proposal 2025-12-07 06:09:27 +09:00
strparser strparser: Fix signed/unsigned mismatch bug 2025-12-07 06:09:29 +09:00
sunrpc SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path 2026-03-04 07:19:55 -05:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: fix RCU dereference race in tipc_aead_users_dec() 2026-03-04 07:20:34 -05:00
tls tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). 2026-02-06 16:42:01 +01:00
unix af_unix: Don't leave consecutive consumed OOB skbs. 2025-10-02 13:39:14 +02:00
vmw_vsock vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 2026-03-04 07:20:11 -05:00
wireless wifi: cfg80211: wext: fix IGTK key ID off-by-one 2026-03-04 07:20:22 -05:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-26 18:21:23 -04:00
xdp xsk: fix OOB map writes when deleting elements 2024-12-14 19:51:33 +01:00
xfrm espintcp: fix skb leaks 2026-02-06 16:42:03 +01:00
compat.c net: Return the correct errno code 2021-06-03 15:13:56 -07:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. 2026-01-19 13:10:11 +01:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00