Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Dan Carpenter 25b42be4e0 netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() ... commit c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63 upstream. The problem is in nft_byteorder_eval() where we are iterating through a loop and writing to dst[0], dst[1], dst[2] and so on... On each iteration we are writing 8 bytes. But dst[] is an array of u32 so each element only has space for 4 bytes. That means that every iteration overwrites part of the previous element. I spotted this bug while reviewing commit caf3ef7468f7 ("netfilter: nf_tables: prevent OOB access in nft_byteorder_eval") which is a related issue. I think that the reason we have not detected this bug in testing is that most of time we only write one element. Fixes: ce1e7989d9 ("netfilter: nft_byteorder: provide 64bit le/be conversion") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> [Ajay: Modified to apply on v5.4.y] Signed-off-by: Ajay Kaher <ajay.kaher@broadcom.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-02-23 08:25:15 +01:00
..
acpi
asm-generic	asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation	2023-12-20 15:41:22 +01:00
clocksource
crypto	crypto: af_alg - Disallow multiple in-flight AIO requests	2024-01-25 14:34:23 -08:00
drm	drm/mipi-dsi: Fix detach call without attach	2024-02-23 08:25:00 +01:00
dt-bindings
keys
kvm
linux	lsm: new security_file_ioctl_compat() hook	2024-02-23 08:25:15 +01:00
math-emu
media
misc
net	netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()	2024-02-23 08:25:15 +01:00
pcmcia
ras
rdma
scsi	scsi: core: Introduce the scsi_cmd_to_rq() function	2023-12-08 08:44:28 +01:00
soc
sound
target
trace
uapi	netfilter: nft_compat: reject unused compat flag	2024-02-23 08:25:07 +01:00
vdso
video
xen