android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6c8f44b025
android_kernel_xiaomi_sm8450/net
History
Roded Zats 6c8f44b025 rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation 
[ Upstream commit 1aec77b2bb2ed1db0f5efc61c4c1ca3813307489 ]

Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a
struct ifla_vf_vlan_info so the size of such attribute needs to be at least
of sizeof(struct ifla_vf_vlan_info) which is 14 bytes.
The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes)
which is less than sizeof(struct ifla_vf_vlan_info) so this validation
is not enough and a too small attribute might be cast to a
struct ifla_vf_vlan_info, this might result in an out of bands
read access when accessing the saved (casted) entry in ivvl.

Fixes: 79aab093a0 ("net: Update API for VF vlan protocol 802.1ad support")
Signed-off-by: Roded Zats <rzats@paloaltonetworks.com>
Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Link: https://lore.kernel.org/r/20240502155751.75705-1-rzats@paloaltonetworks.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-05-17 11:48:07 +02:00
..
6lowpan
9p 9p/net: fix possible memory leak in p9_check_errors() 2024-01-05 15:12:29 +01:00
802 mrp: introduce active flags to prevent UAF when applicant uninit 2023-01-14 10:16:18 +01:00
8021q vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING 2024-02-23 08:41:55 +01:00
appletalk appletalk: Fix Use-After-Free in atalk_ioctl 2023-12-20 15:44:29 +01:00
atm atm: Fix Use-After-Free in do_vcc_ioctl 2023-12-20 15:44:28 +01:00
ax25 net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg 2022-06-22 14:13:17 +02:00
batman-adv batman-adv: Avoid infinite loop trying to resize local TT 2024-05-02 16:23:33 +02:00
bluetooth Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout 2024-05-17 11:48:06 +02:00
bpf bpf: Move skb->len == 0 checks into __bpf_redirect 2023-01-14 10:15:31 +01:00
bpfilter
bridge net: bridge: fix multicast-to-unicast with fraglist GSO 2024-05-17 11:48:01 +02:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:45:11 +01:00
can can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) 2024-02-23 08:42:29 +01:00
ceph libceph: use kernel_connect() 2023-10-25 11:54:15 +02:00
core rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation 2024-05-17 11:48:07 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 11:57:50 +02:00
dccp dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2023-11-20 11:06:55 +01:00
decnet Remove DECnet support from kernel 2023-06-21 15:45:38 +02:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:37:50 -08:00
dsa net: dsa: tag_sja1105: fix MAC DA patching from meta frames 2023-07-27 08:44:10 +02:00
ethernet ethernet: Add helper for assigning packet type when dest address does not match device address 2024-05-02 16:23:44 +02:00
ethtool ethtool: netlink: Add missing ethnl_ops_begin/complete 2024-01-25 14:37:56 -08:00
hsr hsr: Handle failures in module init 2024-03-26 18:22:03 -04:00
ieee802154 net: ieee802154: fix error return code in dgram_bind() 2022-11-03 23:57:51 +09:00
ife net: sched: ife: fix potential use-after-free 2024-01-05 15:12:24 +01:00
ipv4 tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). 2024-05-17 11:48:06 +02:00
ipv6 xfrm: Preserve vlan tags for transport mode software GRO 2024-05-17 11:48:06 +02:00
iucv net/iucv: fix the allocation size of iucv_path_table array 2024-03-26 18:21:46 -04:00
kcm net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function 2024-03-26 18:21:54 -04:00
key net: af_key: fix sadb_x_filter validation 2023-08-26 15:26:51 +02:00
l2tp net l2tp: drop flow hash on forward 2024-05-17 11:48:00 +02:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-27 13:53:50 +02:00
lapb
llc llc: call sock_orphan() at release time 2024-02-23 08:42:17 +01:00
mac80211 wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc 2024-05-17 11:48:02 +02:00
mac802154 mac802154: fix llsec key resources release in mac802154_llsec_key_del 2024-04-13 12:58:25 +02:00
mpls net: mpls: fix stale pointer if allocation fails during device rename 2023-02-22 12:55:58 +01:00
mptcp mptcp: don't account accept() of non-MPC client as fallback to TCP 2024-04-13 12:59:38 +02:00
ncsi net/ncsi: Fix netlink major/minor version numbers 2024-01-25 14:37:44 -08:00
netfilter netfilter: nf_tables: honor table dormant flag from netdev release event path 2024-05-02 16:23:42 +02:00
netlabel calipso: fix memory leak in netlbl_calipso_add_pass() 2024-01-25 14:37:40 -08:00
netlink netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter 2024-03-06 14:37:48 +00:00
netrom netrom: Fix data-races around sysctl_net_busy_read 2024-03-15 10:48:17 -04:00
nfc nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet 2024-04-13 12:59:14 +02:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:48:00 +02:00
openvswitch net: openvswitch: Fix Use-After-Free in ovs_ct_exit 2024-05-02 16:23:41 +02:00
packet packet: annotate data-races around ignore_outgoing 2024-03-26 18:22:03 -04:00
phonet phonet: refcount leak in pep_sock_accep 2022-01-11 15:25:01 +01:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:27:06 +01:00
qrtr net: qrtr: ns: Return 0 if server port is not present 2024-01-25 14:37:38 -08:00
rds net/rds: fix possible cp null dereference 2024-04-13 12:59:19 +02:00
rfkill net: rfkill: gpio: set GPIO direction 2024-01-05 15:12:28 +01:00
rose net/rose: fix races in rose_kill_by_device() 2024-01-05 15:12:24 +01:00
rxrpc rxrpc: Fix response to PING RESPONSE ACKs to a dead call 2024-02-23 08:42:20 +01:00
sched net/sched: act_skbmod: prevent kernel-infoleak 2024-04-13 12:59:26 +02:00
sctp sctp: update hb timer immediately after users change hb_interval 2023-10-10 21:53:39 +02:00
smc net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() 2024-04-13 12:59:43 +02:00
strparser bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-18 14:04:27 +01:00
sunrpc sunrpc: add a struct rpc_stats arg to rpc_create_args 2024-05-17 11:47:58 +02:00
switchdev
tipc tipc: fix a possible memleak in tipc_buf_append 2024-05-17 11:48:01 +02:00
tls tls: stop recv() if initial process_rx_list gave us non-DATA 2024-03-01 13:16:51 +01:00
unix af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc(). 2024-05-02 16:23:43 +02:00
vmw_vsock virtio/vsock: fix logic which reduces credit update messages 2024-01-25 14:37:45 -08:00
wimax
wireless wifi: cfg80211: fix rdev_dump_mpp() arguments order 2024-05-17 11:48:02 +02:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-26 18:21:54 -04:00
xdp xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING 2024-05-02 16:23:33 +02:00
xfrm xfrm: Preserve vlan tags for transport mode software GRO 2024-05-17 11:48:06 +02:00
compat.c
devres.c
Kconfig Remove DECnet support from kernel 2023-06-21 15:45:38 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:45:38 +02:00
socket.c net: Save and restore msg_namelen in sock_sendmsg 2024-01-15 18:48:04 +01:00
sysctl_net.c