kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/net/batman-adv
History
Stanislav Fort 2008070945 batman-adv: fix OOB read/write in network-coding decode 
commit d77b6ff0ce upstream.

batadv_nc_skb_decode_packet() trusts coded_len and checks only against
skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing
payload headroom, and the source skb length is not verified, allowing an
out-of-bounds read and a small out-of-bounds write.

Validate that coded_len fits within the payload area of both destination
and source sk_buffs before XORing.

Fixes: 2df5278b02 ("batman-adv: network coding - receive coded packets and decode them")
Cc: stable@vger.kernel.org
Reported-by: Stanislav Fort <disclosure@aisle.com>
Signed-off-by: Stanislav Fort <stanislav.fort@aisle.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-09-09 18:58:18 +02:00
..
bat_algo.c batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bat_algo.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bat_iv_ogm.c batman-adv: Ignore own maximum aggregation size during RX 2025-03-28 22:03:31 +01:00
bat_iv_ogm.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bat_v.c batman-adv: Drop unmanaged ELP metric worker 2025-02-21 14:01:28 +01:00
bat_v.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bat_v_elp.c batman-adv: Drop unmanaged ELP metric worker 2025-02-21 14:01:28 +01:00
bat_v_elp.h batman-adv: Drop unmanaged ELP metric worker 2025-02-21 14:01:28 +01:00
bat_v_ogm.c batman-adv: Ignore own maximum aggregation size during RX 2025-03-28 22:03:31 +01:00
bat_v_ogm.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bitarray.c batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bitarray.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bridge_loop_avoidance.c batman-adv: Switch to linux/sprintf.h 2023-11-14 08:16:34 +01:00
bridge_loop_avoidance.h batman-adv: Remove the repeated declaration 2021-05-30 13:38:27 +02:00
distributed-arp-table.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
distributed-arp-table.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
fragmentation.c batman-adv: mcast: implement multicast packet reception and forwarding 2023-11-14 08:16:34 +01:00
fragmentation.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
gateway_client.c batman-adv: Switch to linux/sprintf.h 2023-11-14 08:16:34 +01:00
gateway_client.h batman-adv: Check ptr for NULL before reducing its refcnt 2021-08-08 20:21:40 +02:00
gateway_common.c batman-adv: Drop per algo GW section class code 2023-08-14 18:01:21 +02:00
gateway_common.h batman-adv: Drop per algo GW section class code 2023-08-14 18:01:21 +02:00
hard-interface.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-08-24 10:51:39 -07:00
hard-interface.h batman-adv: Check ptr for NULL before reducing its refcnt 2021-08-08 20:21:40 +02:00
hash.c batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
hash.h batman-adv: Fix spelling mistakes 2021-06-02 08:46:03 +02:00
Kconfig This feature/cleanup patchset is an updated version of the pull request 2021-02-08 11:32:40 -08:00
log.c isystem: ship and use stdarg.h 2021-08-19 09:02:55 +09:00
log.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
main.c genetlink: remove linux/genetlink.h 2024-04-01 21:44:34 -07:00
main.h batman-adv: Start new development cycle 2024-03-29 20:18:21 +01:00
Makefile batman-adv: mcast: implement multicast packet reception and forwarding 2023-11-14 08:16:34 +01:00
multicast.c batman-adv: mcast: fix memory leak on deleting a batman-adv interface 2024-01-27 09:13:39 +01:00
multicast.h batman-adv: mcast: implement multicast packet generation 2023-11-14 08:16:34 +01:00
multicast_forw.c batman-adv: mcast: shrink tracker packet after scrubbing 2023-11-14 08:16:34 +01:00
netlink.c genetlink: remove linux/genetlink.h 2024-04-01 21:44:34 -07:00
netlink.h batman-adv: Keep batadv_netlink_notify_* static 2023-08-14 18:01:21 +02:00
network-coding.c batman-adv: fix OOB read/write in network-coding decode 2025-09-09 18:58:18 +02:00
network-coding.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
originator.c batman-adv: Don't accept TT entries for out-of-spec VIDs 2024-06-03 10:20:43 +02:00
originator.h batman-adv: mcast: implement multicast packet reception and forwarding 2023-11-14 08:16:34 +01:00
routing.c batman-adv: mcast: implement multicast packet reception and forwarding 2023-11-14 08:16:34 +01:00
routing.h batman-adv: mcast: implement multicast packet reception and forwarding 2023-11-14 08:16:34 +01:00
send.c batman-adv: Migrate to linux/container_of.h 2022-03-02 09:00:13 +01:00
send.h batman-adv: bcast: queue per interface, if needed 2021-05-17 12:00:44 +02:00
soft-interface.c netdev_features: convert NETIF_F_NETNS_LOCAL to dev->netns_local 2024-09-03 11:36:43 +02:00
soft-interface.h batman-adv: Check ptr for NULL before reducing its refcnt 2021-08-08 20:21:40 +02:00
tp_meter.c batman-adv: Migrate to linux/container_of.h 2022-03-02 09:00:13 +01:00
tp_meter.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
trace.c batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
trace.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
translation-table.c batman-adv: Do not let TT changes list grows indefinitely 2024-12-19 18:13:11 +01:00
translation-table.h batman-adv: Check ptr for NULL before reducing its refcnt 2021-08-08 20:21:40 +02:00
tvlv.c batman-adv: tvlv: prepare for tvlv enabled multicast packet type 2023-01-21 19:01:59 +01:00
tvlv.h batman-adv: tvlv: prepare for tvlv enabled multicast packet type 2023-01-21 19:01:59 +01:00
types.h batman-adv: Drop unmanaged ELP metric worker 2025-02-21 14:01:28 +01:00