Dan Carpenter
6491d69839
nfc: nci: Potential off by one in ->pipes[] array
...
This is similar to commit e285d5bfb7 ("NFC: Fix the number of pipes")
where we changed NFC_HCI_MAX_PIPES from 127 to 128.
As the comment next to the define explains, the pipe identifier is 7
bits long. The highest possible pipe is 127, but the number of possible
pipes is 128. As the code is now, then there is potential for an
out of bounds array access:
net/nfc/nci/hci.c:297 nci_hci_cmd_received() warn: array off by one?
'ndev->hci_dev->pipes[pipe]' '0-127 == 127'
Fixes: 11f54f2286 ("NFC: nci: Add HCI over NCI protocol support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-04-06 15:05:07 -07:00
..
9p
9p: Add refcount to p9_req_t
2018-09-08 01:39:47 +09:00
bluetooth
Bluetooth: Add quirk for reading BD_ADDR from fwnode property
2019-02-26 10:08:26 +01:00
caif
iucv
net/af_iucv: locate IUCV header via skb_network_header()
2018-09-26 09:56:07 -07:00
netfilter
netfilter: nf_tables: bogus EBUSY when deleting set after flush
2019-03-11 13:19:24 +01:00
netns
netns: provide pure entropy for net_hash_mix()
2019-03-28 17:00:45 -07:00
nfc
nfc: nci: Potential off by one in ->pipes[] array
2019-04-06 15:05:07 -07:00
phonet
phonet: fix building with clang
2019-02-21 16:23:56 -08:00
sctp
sctp: get sctphdr by offset in sctp_compute_cksum
2019-03-18 18:16:12 -07:00
tc_act
net/sched: don't dereference a->goto_chain to read the chain index
2019-03-21 13:26:42 -07:00
6lowpan.h
act_api.h
net/sched: let actions use RCU to access 'goto_chain'
2019-03-21 13:26:42 -07:00
addrconf.h
ipv6_stub: add ipv6_route_input stub/proxy.
2019-02-13 18:27:55 -08:00
af_ieee802154.h
ieee802154: add rx LQI from userspace
2018-07-13 12:18:18 -04:00
af_rxrpc.h
Revert "rxrpc: Allow failed client calls to be retried"
2019-01-15 21:33:36 -08:00
af_unix.h
net: split out functions related to registering inflight socket files
2019-02-28 08:24:23 -07:00
af_vsock.h
vsock: split dwork to avoid reinitializations
2018-08-07 12:39:13 -07:00
ah.h
arp.h
atmclip.h
ax25.h
ax25: fix possible use-after-free
2019-01-23 11:18:00 -08:00
ax88796.h
net-next: ax88796: add interrupt status callback to platform data
2018-04-19 16:11:11 -04:00
bond_3ad.h
bonding: count master 3ad stats separately
2019-01-24 22:18:48 -08:00
bond_alb.h
bond_options.h
bonding.h
bonding: avoid possible dead-lock
2018-09-26 20:22:19 -07:00
busy_poll.h
net: remove sock_poll_busy_flag
2018-07-30 09:10:25 -07:00
calipso.h
cfg80211-wext.h
cfg80211.h
cfg80211: allow sending vendor events unicast
2019-02-22 13:46:43 +01:00
cfg802154.h
checksum.h
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
cipso_ipv4.h
cls_cgroup.h
codel.h
codel_impl.h
codel_qdisc.h
compat.h
net: remove compat_sys_*() prototypes from net/compat.h
2018-04-02 20:16:17 +02:00
datalink.h
dcbevent.h
dcbnl.h
net: dcb: Add priority-to-DSCP map getters
2018-07-27 13:17:50 -07:00
devlink.h
devlink: Add support for direct reporter health state update
2019-03-04 11:00:43 -08:00
dn.h
dn_dev.h
dn_fib.h
dn_neigh.h
dn_nsp.h
dn_route.h
dsa.h
net: dsa: add KSZ9893 switch tagging support
2019-03-03 13:48:49 -08:00
dsfield.h
dst.h
geneve, vxlan: Don't set exceptions if skb->len < mtu
2018-10-17 21:51:13 -07:00
dst_cache.h
dst_metadata.h
dst_ops.h
erspan.h
erspan: set bso bit based on mirrored packet's len
2018-05-20 18:31:42 -04:00
esp.h
ethoc.h
failover.h
net: Introduce generic failover module
2018-05-28 22:59:54 -04:00
fib_notifier.h
fib_rules.h
net: fib_rules: add extack support
2018-04-23 10:21:24 -04:00
firewire.h
flow.h
route: Add multipath_hash in flowi_common to make user-define hash
2019-02-27 12:50:17 -08:00
flow_dissector.h
net/flow_dissector: correct comments on enum flow_dissector_key_id
2018-11-30 13:21:52 -08:00
flow_offload.h
flow_offload: fix block stats
2019-02-13 21:07:47 -08:00
fou.h
fq.h
fq_impl.h
garp.h
gen_stats.h
net: align gnet_stats_basic_cpu struct
2018-11-17 21:37:29 -08:00
genetlink.h
genetlink: constify genl_err_attr() argument
2018-08-29 19:42:52 -07:00
geneve.h
net: add netif_is_geneve()
2018-11-07 23:00:23 -08:00
gre.h
net: Add netif_is_gretap()/netif_is_ip6gretap()
2018-12-10 15:53:04 -08:00
gro_cells.h
gtp.h
gue.h
hwbm.h
icmp.h
net: Add __icmp_send helper.
2019-02-25 14:32:35 -08:00
ieee80211_radiotap.h
wireless-drivers-next patches for 5.1
2019-02-22 12:56:24 -08:00
ieee802154_netdev.h
if_inet6.h
net/ipv6: Add anycast addresses to a global hashtable
2018-11-02 23:54:56 -07:00
ife.h
net: sched: ife: handle malformed tlv length
2018-04-22 21:12:00 -04:00
ila.h
inet6_connection_sock.h
inet6_hashtables.h
net: allow binding socket in a VRF when there's an unbound socket
2018-11-07 16:12:38 -08:00
inet_common.h
net: use indirect call wrappers at GRO transport layer
2018-12-15 13:23:02 -08:00
inet_connection_sock.h
tcp: change pingpong threshold to 3
2019-01-27 13:29:43 -08:00
inet_ecn.h
inet: Refactor INET_ECN_decapsulate()
2018-10-17 17:45:07 -07:00
inet_frag.h
net: remove unused struct inet_frag_queue.fragments field
2019-02-26 08:27:05 -08:00
inet_hashtables.h
net: dccp: fix kernel crash on module load
2018-12-24 15:27:56 -08:00
inet_sock.h
net: ensure unbound stream socket to be chosen when not in a VRF
2018-11-07 16:12:38 -08:00
inet_timewait_sock.h
net-tcp: remove useless tw_timeout field
2018-06-05 10:45:24 -04:00
inetpeer.h
net: ipv4: use a dedicated counter for icmp_v4 redirect packets
2019-02-08 21:50:15 -08:00
ip.h
vrf: check accept_source_route on the original netdevice
2019-04-01 10:44:58 -07:00
ip6_checksum.h
ip6_fib.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-10-19 11:03:06 -07:00
ip6_route.h
net: Add struct for fib dump filter
2018-10-16 00:13:12 -07:00
ip6_tunnel.h
udp: Support for error handlers of tunnels with arbitrary destination port
2018-11-08 17:13:08 -08:00
ip_fib.h
net: ipv4: Fix memory leak in network namespace dismantle
2019-01-15 13:33:44 -08:00
ip_tunnels.h
route: Add multipath_hash in flowi_common to make user-define hash
2019-02-27 12:50:17 -08:00
ip_vs.h
ipvs: avoid indirect calls when calculating checksums
2019-01-28 11:15:58 +01:00
ipcomp.h
ipconfig.h
ipv6.h
ipv6: factor out protocol delivery helper
2018-11-07 16:23:05 -08:00
ipv6_frag.h
net: IP6 defrag: use rbtrees for IPv6 defrag
2019-01-25 21:37:11 -08:00
ipx.h
iw_handler.h
kcm.h
l3mdev.h
ipvlan, l3mdev: fix broken l3s mode wrt local routes
2019-01-30 22:13:34 -08:00
lag.h
net: Add lag.h, net_lag_port_dev_txable()
2018-07-11 23:10:19 -07:00
lapb.h
lib80211.h
llc.h
llc: avoid blocking in llc_sap_close()
2018-09-13 09:04:58 -07:00
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc: delete timers synchronously in llc_sk_free()
2018-04-22 14:55:03 -04:00
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
lwtunnel.h
bpf: implement BPF_LWT_ENCAP_IP mode in bpf_lwt_push_encap
2019-02-13 18:27:55 -08:00
mac80211.h
mac80211: notify driver on subsequent CSA beacons
2019-02-22 13:45:51 +01:00
mac802154.h
mip6.h
mld.h
mpls.h
mpls_iptunnel.h
mrp.h
ncsi.h
ndisc.h
neighbour.h
neighbour: register rtnl doit handler
2018-12-19 13:37:34 -08:00
net_failover.h
net: Introduce net_failover driver
2018-05-28 22:59:54 -04:00
net_namespace.h
netns: provide pure entropy for net_hash_mix()
2019-03-28 17:00:45 -07:00
net_ratelimit.h
netevent.h
net: ipv4: Notify about changes to ip_forward_update_priority
2018-08-01 09:52:30 -07:00
netlabel.h
netlink.h
netlink: reduce NLA_POLICY_NESTED{,_ARRAY} arguments
2019-02-01 11:06:55 +01:00
netprio_cgroup.h
netrom.h
proc: introduce proc_create_seq{,_data}
2018-05-16 07:23:35 +02:00
nexthop.h
net: fix rtnh_ok()
2018-04-07 22:32:31 -04:00
nl802154.h
nsh.h
p8022.h
page_pool.h
xdp: introduce xdp_return_frame_rx_napi
2018-05-24 18:36:15 -07:00
ping.h
ipv{4,6}/ping: simplify proc file creation
2018-05-16 07:23:35 +02:00
pkt_cls.h
net: sched: set dedicated tcf_walker flag when tp is empty
2019-02-25 10:18:17 -08:00
pkt_sched.h
net: sched: extend Qdisc with rcu
2018-09-25 20:17:35 -07:00
pptp.h
protocol.h
net: Convert protocol error handlers from void to int
2018-11-08 17:13:08 -08:00
psample.h
psnap.h
raw.h
net: fix raw socket lookup device bind matching with VRFs
2018-11-07 16:12:39 -08:00
rawv6.h
red.h
regulatory.h
cfg80211: make wmm_rule part of the reg_rule structure
2018-08-28 11:11:47 +02:00
request_sock.h
net: keep refcount warning in reqsk_free()
2019-03-09 19:51:44 -08:00
rose.h
proc: introduce proc_create_seq{,_data}
2018-05-16 07:23:35 +02:00
route.h
net-ipv4: remove 2 always zero parameters from ipv4_redirect()
2018-09-26 20:30:55 -07:00
rsi_91x.h
rtnetlink.h
net: Add extack argument to rtnl_create_link
2018-11-06 15:00:45 -08:00
sch_generic.h
net: sched: introduce and use qdisc tree flush/purge helpers
2019-04-01 14:50:13 -07:00
scm.h
pids: Compute task_tgid using signal->leader_pid
2018-07-21 10:43:12 -05:00
secure_seq.h
seg6.h
net: seg6.h: remove an unused #include
2018-12-20 16:56:04 -08:00
seg6_hmac.h
rhashtable: split rhashtable.h
2018-06-22 13:43:27 +09:00
seg6_local.h
bpf: add End.DT6 action to bpf_lwt_seg6_action helper
2018-07-31 09:22:48 +02:00
slhc_vj.h
slip: Check if rstate is initialized before uncompressing
2018-04-11 10:33:46 -04:00
smc.h
net/smc: add smcd support to the pnet table
2019-02-21 10:34:37 -08:00
snmp.h
sock.h
packets: Always register packet sk in the same order
2019-03-18 17:58:39 -07:00
sock_reuseport.h
bpf: Enable BPF_PROG_TYPE_SK_REUSEPORT bpf prog in reuseport selection
2018-08-11 01:58:46 +02:00
Space.h
stp.h
strparser.h
strparser: Add __strp_unpause and use it in ktls.
2018-06-06 14:07:53 -04:00
switchdev.h
switchdev: Remove unused transaction item queue
2019-03-01 21:35:19 -08:00
tcp.h
tcp: convert tcp_md5_needed to static_branch API
2019-02-26 13:16:03 -08:00
tcp_states.h
timewait_sock.h
tipc.h
flow_dissector: do not rely on implicit casts
2018-05-08 00:02:41 -04:00
tls.h
tls: Fix write space handling
2019-03-03 22:10:16 -08:00
transp_v6.h
ipv6: fold sockcm_cookie into ipcm6_cookie
2018-07-07 10:58:49 +09:00
tso.h
tun_proto.h
udp.h
net: Convert protocol error handlers from void to int
2018-11-08 17:13:08 -08:00
udp_tunnel.h
udp_tunnel: add config option to bind to a device
2018-12-03 14:15:26 -08:00
udplite.h
vsock_addr.h
vxlan.h
vxlan: add extack support for create and changelink
2019-02-26 08:54:37 -08:00
wext.h
wimax.h
x25.h
x25device.h
xdp.h
xdp: export xdp_rxq_info_unreg_mem_model
2018-08-29 12:25:53 -07:00
xdp_sock.h
xsk: fix umem memory leak on cleanup
2019-03-16 01:27:51 +01:00
xfrm.h
xfrm: destroy xfrm_state synchronously on net exit path
2019-02-05 06:29:20 +01:00