No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Dan Carpenter 25b42be4e0 netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
commit c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63 upstream.

The problem is in nft_byteorder_eval() where we are iterating through a
loop and writing to dst[0], dst[1], dst[2] and so on...  On each
iteration we are writing 8 bytes.  But dst[] is an array of u32 so each
element only has space for 4 bytes.  That means that every iteration
overwrites part of the previous element.

I spotted this bug while reviewing commit caf3ef7468f7 ("netfilter:
nf_tables: prevent OOB access in nft_byteorder_eval") which is a related
issue.  I think that the reason we have not detected this bug in testing
is that most of time we only write one element.

Fixes: ce1e7989d9 ("netfilter: nft_byteorder: provide 64bit le/be conversion")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
[Ajay: Modified to apply on v5.4.y]
Signed-off-by: Ajay Kaher <ajay.kaher@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-02-23 08:25:15 +01:00
arch mips: Fix max_mapnr being uninitialized on early stages 2024-02-23 08:25:13 +01:00
block blk-mq: fix IO hang from sbitmap wakeup race 2024-02-23 08:25:03 +01:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:11:22 +02:00
crypto crypto: api - Disallow identical driver names 2024-02-23 08:24:48 +01:00
Documentation net: sysfs: Fix /sys/class/net/<iface> path 2024-02-23 08:25:05 +01:00
drivers drm/msm/dsi: Enable runtime PM 2024-02-23 08:25:14 +01:00
fs lsm: new security_file_ioctl_compat() hook 2024-02-23 08:25:15 +01:00
include netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() 2024-02-23 08:25:15 +01:00
init rootfs: Fix support for rootfstype= when root= is given 2024-01-25 14:34:30 -08:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:23:06 +01:00
kernel sched/membarrier: reduce the ability to hammer on sys_membarrier 2024-02-23 08:25:14 +01:00
lib ida: Fix crash in ida_free when the bitmap is empty 2024-01-25 14:34:21 -08:00
LICENSES
mm mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again 2024-02-23 08:25:10 +01:00
net netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() 2024-02-23 08:25:15 +01:00
samples samples/bpf: Fix buffer overflow in tcp_basertt 2023-07-27 08:37:07 +02:00
scripts kbuild: Fix changing ELF file type for output of gen_btf for big endian 2024-02-23 08:25:10 +01:00
security lsm: new security_file_ioctl_compat() hook 2024-02-23 08:25:15 +01:00
sound ALSA: hda/conexant: Add quirk for SWS JS201D 2024-02-23 08:25:12 +01:00
tools selftests: net: avoid just another constant wait 2024-02-23 08:25:06 +01:00
usr
virt KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache 2024-02-23 08:25:14 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS iio: stx104: Move to addac subdirectory 2023-08-30 16:27:12 +02:00
Makefile Linux 5.4.268 2024-01-25 14:34:33 -08:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.