Stanislav Fort a67c6397fc batman-adv: fix OOB read/write in network-coding decode ... commit d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087 upstream. batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing. Fixes: 2df5278b02 ("batman-adv: network coding - receive coded packets and decode them") Cc: stable@vger.kernel.org Reported-by: Stanislav Fort <disclosure@aisle.com> Signed-off-by: Stanislav Fort <stanislav.fort@aisle.com> Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-09-09 19:02:34 +02:00
..
6lowpan
9p	netfs: Fix the request's work item to not require a ref	2025-05-21 14:35:20 +02:00
802	treewide, timers: Rename from_timer() to timer_container_of()	2025-06-08 09:07:37 +02:00
8021q	net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime	2025-07-17 07:44:26 -07:00
appletalk	net: remove sock_i_uid()	2025-09-09 19:02:26 +02:00
atm	net: atm: fix memory leak in atm_register_sysfs when device_register fail	2025-09-09 19:02:27 +02:00
ax25	ax25: properly unshare skbs in ax25_kiss_rcv()	2025-09-09 19:02:27 +02:00
batman-adv	batman-adv: fix OOB read/write in network-coding decode	2025-09-09 19:02:34 +02:00
bluetooth	net: remove sock_i_uid()	2025-09-09 19:02:26 +02:00
bpf	selftests/bpf: Add test to access const void pointer argument in tracing program	2025-04-23 11:26:22 -07:00
bridge	netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm	2025-09-09 19:02:20 +02:00
caif	caif: reduce stack size, again	2025-08-15 16:38:40 +02:00
can	treewide, timers: Rename from_timer() to timer_container_of()	2025-06-08 09:07:37 +02:00
ceph	A small CephFS encryption-related fix and a dead code cleanup.	2025-04-25 15:51:28 -07:00
core	net: lockless sock_i_ino()	2025-09-09 19:02:26 +02:00
dcb
devlink	devlink: let driver opt out of automatic phys_port_name generation	2025-08-28 16:34:42 +02:00
dns_resolver
dsa	net: dsa: tag_brcm: legacy: fix pskb_may_pull length	2025-05-30 19:20:18 -07:00
ethernet
ethtool	Including fixes from bluetooth and wireless.	2025-06-12 09:50:36 -07:00
handshake
hsr	net, hsr: reject HSR frame if skb can't hold tag	2025-08-28 16:34:31 +02:00
ieee802154	treewide, timers: Rename from_timer() to timer_container_of()	2025-06-08 09:07:37 +02:00
ife
ipv4	ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()	2025-09-09 19:02:26 +02:00
ipv6	net: remove sock_i_uid()	2025-09-09 19:02:26 +02:00
iucv
kcm	net: kcm: Fix race condition in kcm_unattach()	2025-08-20 18:40:52 +02:00
key	net: remove sock_i_uid()	2025-09-09 19:02:26 +02:00
l2tp	l2tp: do not use sock_hold() in pppol2tp_session_get_sock()	2025-09-04 16:55:43 +02:00
l3mdev
lapb	treewide, timers: Rename from_timer() to timer_container_of()	2025-06-08 09:07:37 +02:00
llc	net: remove sock_i_uid()	2025-09-09 19:02:26 +02:00
mac80211	wifi: mac80211: do not permit 40 MHz EHT operation on 5/6 GHz	2025-09-09 19:02:31 +02:00
mac802154
mctp	mctp: return -ENOPROTOOPT for unknown getsockopt options	2025-09-09 19:02:27 +02:00
mpls	mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().	2025-06-17 18:21:59 -07:00
mptcp	net: lockless sock_i_ino()	2025-09-09 19:02:26 +02:00
ncsi	net: ncsi: Fix buffer overflow in fetching version id	2025-08-20 18:41:19 +02:00
netfilter	netfilter: nf_tables: Introduce NFTA_DEVICE_PREFIX	2025-09-09 19:02:27 +02:00
netlabel	calipso: unlock rcu before returning -EAFNOSUPPORT	2025-06-05 08:03:38 -07:00
netlink	net: lockless sock_i_ino()	2025-09-09 19:02:26 +02:00
netrom	treewide, timers: Rename from_timer() to timer_container_of()	2025-06-08 09:07:37 +02:00
nfc	NFC: nci: uart: Set tty->disc_data only in success path	2025-06-19 08:33:54 -07:00
nsh
openvswitch	openvswitch: Allocate struct ovs_pcpu_storage dynamically	2025-06-17 14:47:46 +02:00
packet	net: remove sock_i_uid()	2025-09-09 19:02:26 +02:00
phonet	net: remove sock_i_uid()	2025-09-09 19:02:26 +02:00
psample
qrtr
rds	replace strncpy with strscpy_pad	2025-05-26 22:28:44 +02:00
rfkill
rose	net: rose: fix a typo in rose_clear_routes()	2025-09-04 16:55:50 +02:00
rxrpc	rxrpc: Fix to use conn aborts for conn-wide failures	2025-07-17 07:50:48 -07:00
sched	net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate	2025-08-28 16:34:49 +02:00
sctp	net: remove sock_i_uid()	2025-09-09 19:02:26 +02:00
shaper
smc	net/smc: Remove validation of reserved bits in CLC Decline message	2025-09-09 19:02:26 +02:00
strparser	strparser: Remove unused __strp_unpause	2025-05-05 16:48:12 -07:00
sunrpc	sunrpc: fix handling of server side tls alerts	2025-08-15 16:39:30 +02:00
switchdev
tipc	net: remove sock_i_uid()	2025-09-09 19:02:26 +02:00
tls	tls: fix handling of zero-length records on the rx_list	2025-08-28 16:34:41 +02:00
unix	net: remove sock_i_uid()	2025-09-09 19:02:26 +02:00
vmw_vsock	vsock/virtio: Validate length in packet header before skb_put()	2025-08-28 16:34:25 +02:00
wireless	wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()	2025-09-09 19:02:25 +02:00
x25	treewide, timers: Rename from_timer() to timer_container_of()	2025-06-08 09:07:37 +02:00
xdp	net: remove sock_i_uid()	2025-09-09 19:02:26 +02:00
xfrm	xfrm: Duplicate SPI Handling	2025-08-20 18:41:13 +02:00
compat.c
devres.c
Kconfig	net: Kconfig NET_DEVMEM selects GENERIC_ALLOCATOR	2025-05-27 17:31:42 -07:00
Kconfig.debug
Makefile
socket.c	net: annotate races around sk->sk_uid	2025-08-15 16:38:40 +02:00
sysctl_net.c