Lei Lu 81cec07d30 sunrpc: fix null pointer dereference on zero-length checksum ... commit 6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 upstream. In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that the value of checksum.len is not less than XDR_UNIT. Fixes: 0653028e8f ("SUNRPC: Convert gss_verify_header() to use xdr_stream") Cc: stable@kernel.org Signed-off-by: Lei Lu <llfamsec@gmail.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-10-15 11:58:09 +02:00
..
6lowpan
9p	net/9p: fix double req put in p9_fd_cancelled	2025-10-12 12:56:23 +02:00
802	net: 802: LLC+SNAP OID:PID lookup on start of skb data	2025-01-17 13:36:11 +01:00
8021q	net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime	2025-07-24 08:53:19 +02:00
appletalk	net: appletalk: Fix use-after-free in AARP proxy probe	2025-08-01 09:47:29 +01:00
atm	net: atm: fix memory leak in atm_register_sysfs when device_register fail	2025-09-09 18:56:25 +02:00
ax25	ax25: properly unshare skbs in ax25_kiss_rcv()	2025-09-09 18:56:25 +02:00
batman-adv	batman-adv: fix OOB read/write in network-coding decode	2025-09-09 18:56:27 +02:00
bluetooth	Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements	2025-10-15 11:58:05 +02:00
bpf	bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()	2025-02-27 04:10:50 -08:00
bpfilter
bridge	net: bridge: Bounce invalid boolopts	2025-09-19 16:32:06 +02:00
caif	caif: reduce stack size, again	2025-08-15 12:08:45 +02:00
can	can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails	2025-09-19 16:32:06 +02:00
ceph	libceph: fix invalid accesses to ceph_connection_v1_info	2025-09-19 16:32:04 +02:00
core	bpf: Explicitly check accesses to bpf_sock_addr	2025-10-15 11:57:53 +02:00
dcb
dccp	net: fix data-races around sk->sk_forward_alloc	2025-01-23 17:21:19 +01:00
devlink
dns_resolver
dsa	net: dsa: microchip: linearize skb for tail-tagging switches	2025-09-09 18:56:31 +02:00
ethernet
ethtool	net: ethtool: Don't call .cleanup_data when prepare_data fails	2025-04-25 10:45:07 +02:00
handshake
hsr	hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr	2025-09-19 16:32:06 +02:00
ieee802154	net: Rename mono_delivery_time to tstamp_type for scalabilty	2025-05-09 09:43:57 +02:00
ife
ipv4	tcp: fix __tcp_close() to only send RST when required	2025-10-15 11:57:58 +02:00
ipv6	minmax: add a few more MIN_T/MAX_T users	2025-09-25 11:00:10 +02:00
iucv
kcm
key
l2tp
l3mdev
lapb
llc	llc: fix data loss when reading from a socket in llc_ui_recvmsg()	2025-06-04 14:42:20 +02:00
mac80211	wifi: mac80211: fix Rx packet handling when pubsta information is not available	2025-10-15 11:58:02 +02:00
mac802154	mac802154: check local interfaces before deleting sdata list	2025-01-23 17:21:13 +01:00
mctp	mctp: return -ENOPROTOOPT for unknown getsockopt options	2025-09-09 18:56:24 +02:00
mpls	mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().	2025-06-27 11:09:02 +01:00
mptcp	mptcp: propagate shutdown to subflows when possible	2025-09-25 11:00:10 +02:00
ncsi	net: ncsi: Fix buffer overflow in fetching version id	2025-08-28 16:28:24 +02:00
netfilter	ipvs: Defer ip_vs_ftp unregister during netns cleanup	2025-10-15 11:58:04 +02:00
netlabel	calipso: unlock rcu before returning -EAFNOSUPPORT	2025-06-19 15:28:46 +02:00
netlink	netlink: add variable-length / auto integers	2025-09-09 18:56:22 +02:00
netrom	netrom: check buffer length before accessing it	2025-01-09 13:32:00 +01:00
nfc	net: nfc: nci: Add parameter validation for packet data	2025-10-15 11:58:08 +02:00
nsh
openvswitch	net: openvswitch: Fix the dead loop of MPLS parse	2025-06-19 15:28:19 +02:00
packet	net/packet: fix a race in packet_set_ring() and packet_notifier()	2025-08-15 12:09:05 +02:00
phonet	phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()	2025-07-24 08:53:12 +02:00
psample
qrtr
rds	rds: ib: Increment i_fastreg_wrs before bailing out	2025-09-25 11:00:08 +02:00
rfkill	net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer	2025-09-25 11:00:08 +02:00
rose	net: rose: fix a typo in rose_clear_routes()	2025-09-04 15:30:28 +02:00
rxrpc	rxrpc: Fix transmission of an abort in response to an abort	2025-07-24 08:53:20 +02:00
sched	net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate	2025-08-28 16:28:49 +02:00
sctp	sctp: initialize more fields in sctp_v6_from_sk()	2025-09-04 15:30:26 +02:00
smc	net/smc: Remove validation of reserved bits in CLC Decline message	2025-09-09 18:56:24 +02:00
strparser	strparser: Add read_sock callback	2025-02-27 04:10:50 -08:00
sunrpc	sunrpc: fix null pointer dereference on zero-length checksum	2025-10-15 11:58:09 +02:00
switchdev	net: switchdev: Convert blocking notification chain to a raw one	2025-03-22 12:50:39 -07:00
tipc	tipc: Fix use-after-free in tipc_conn_close().	2025-07-17 18:35:09 +02:00
tls	tls: make sure to abort the stream if headers are bogus	2025-09-25 11:00:06 +02:00
unix	af_unix: Don't set -ECONNRESET for consumed OOB skb.	2025-07-06 11:00:12 +02:00
vmw_vsock	vsock/virtio: Validate length in packet header before skb_put()	2025-08-28 16:28:36 +02:00
wireless	wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()	2025-09-09 18:56:24 +02:00
x25
xdp	xsk: fix an integer overflow in xp_create_and_assign_umem()	2025-03-28 21:59:55 +01:00
xfrm	xfrm: xfrm_alloc_spi shouldn't use 0 as SPI	2025-10-02 13:42:50 +02:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile	af_unix: Remove CONFIG_UNIX_SCM.	2025-06-04 14:42:22 +02:00
socket.c
sysctl_net.c