Go to file
Stanislav Fort 1e36c6c8dc batman-adv: fix OOB read/write in network-coding decode
commit d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087 upstream.

batadv_nc_skb_decode_packet() trusts coded_len and checks only against
skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing
payload headroom, and the source skb length is not verified, allowing an
out-of-bounds read and a small out-of-bounds write.

Validate that coded_len fits within the payload area of both destination
and source sk_buffs before XORing.

Fixes: 2df5278b02 ("batman-adv: network coding - receive coded packets and decode them")
Cc: stable@vger.kernel.org
Reported-by: Stanislav Fort <disclosure@aisle.com>
Signed-off-by: Stanislav Fort <stanislav.fort@aisle.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-09 18:45:21 +02:00
arch arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro 2025-09-09 18:45:18 +02:00
block block: don't call rq_qos_ops->done_bio if the bio isn't tracked 2025-08-28 16:22:54 +02:00
certs
crypto crypto: xts - Only add ecb if it is not already there 2025-06-27 11:04:01 +01:00
Documentation asm-generic: Add memory barrier dma_mb() 2025-08-28 16:22:57 +02:00
drivers scsi: lpfc: Fix buffer free/clear order in deferred receive path 2025-09-09 18:45:21 +02:00
fs xfs: do not propagate ENODATA disk errors into xattr code 2025-09-04 14:41:46 +02:00
include atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). 2025-09-04 14:41:42 +02:00
init bpf: Clean up sockmap related Kconfigs 2025-06-27 11:04:09 +01:00
io_uring io_uring: fix possible deadlock in io_register_iowq_max_workers() 2024-11-17 14:59:39 +01:00
ipc ipc: fix to protect IPCS lookups using RCU 2025-06-27 11:04:14 +01:00
kernel dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted 2025-09-04 14:41:44 +02:00
lib lib: test_objagg: Set error message in check_expect_hints_stats() 2025-07-17 18:27:47 +02:00
LICENSES
mm mm/page_alloc: detect allocation forbidden by cpuset and bail out early 2025-08-28 16:22:58 +02:00
net batman-adv: fix OOB read/write in network-coding decode 2025-09-09 18:45:21 +02:00
samples samples: mei: Fix building on musl libc 2025-08-28 16:22:32 +02:00
scripts kconfig: lxdialog: fix 'space' to (de)select options 2025-08-28 16:22:47 +02:00
security securityfs: don't pin dentries twice, once is enough... 2025-08-28 16:22:40 +02:00
sound ALSA: usb-audio: Add mute TLV for playback volumes on some devices 2025-09-09 18:45:20 +02:00
tools selftests: mptcp: pm: check flush doesn't reset limits 2025-08-28 16:22:58 +02:00
usr kbuild: hdrcheck: fix cross build with clang 2025-06-27 11:04:11 +01:00
virt KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() 2024-10-22 15:39:24 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore Remove *.orig pattern from .gitignore 2024-10-17 15:07:59 +02:00
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS platform: Add Surface platform directory 2025-06-27 11:04:19 +01:00
Makefile Linux 5.10.242 2025-09-04 14:41:46 +02:00
README

Linux kernel

There are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. Please read Documentation/admin-guide/README.rst first.

In order to build the documentation, use make htmldocs or make pdfdocs. The formatted documentation can also be read online at:

https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory, several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the requirements for building and running the kernel, and information about the problems which may result by upgrading your kernel.