Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Xin Long 9b5d42aeaf sctp: properly validate chunk size in sctp_sf_ootb() ... [ Upstream commit 0ead60804b64f5bd6999eec88e503c6a1a242d41 ] A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add size validation when walking chunks") is also required in sctp_sf_ootb() to address a crash reported by syzbot: BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166 sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243 sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159 ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233 Reported-by: syzbot+f0cbb34d39392f2746ca@syzkaller.appspotmail.com Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/a29ebb6d8b9f8affd0f9abb296faafafe10c17d8.1730223981.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-11-17 14:58:50 +01:00
..
6lowpan
9p	net/9p: fix uninit-value in p9_client_rpc()	2024-06-16 13:28:51 +02:00
802
8021q	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING	2024-02-23 08:24:50 +01:00
appletalk
atm
ax25
batman-adv	batman-adv: Don't accept TT entries for out-of-spec VIDs	2024-07-05 09:08:31 +02:00
bluetooth	Bluetooth: bnep: fix wild-memory-access in proto_unregister	2024-11-08 16:20:50 +01:00
bpf
bpfilter
bridge	netfilter: br_netfilter: fix panic with metadata_dst skb	2024-11-08 16:20:45 +01:00
caif
can	can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().	2024-11-08 16:20:27 +01:00
ceph	libceph: fix race between delayed_work() and ceph_monc_stop()	2024-07-18 11:40:55 +02:00
core	net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension	2024-11-08 16:20:53 +01:00
dcb
dccp	net: annotate lockless accesses to sk->sk_max_ack_backlog	2024-11-08 16:20:46 +01:00
decnet
dns_resolver
dsa
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-05-02 16:18:36 +02:00
hsr	hsr: Handle failures in module init	2024-03-26 18:22:25 -04:00
ieee802154
ife
ipv4	ipv4: give an IPv4 dev to blackhole_netdev	2024-11-08 16:20:49 +01:00
ipv6	net: annotate lockless accesses to sk->sk_ack_backlog	2024-11-08 16:20:46 +01:00
iucv	s390/iucv: fix receive buffer virtual vs physical address confusion	2024-09-04 13:14:57 +02:00
kcm	kcm: Serialise kcm_sendmsg() for the same socket.	2024-09-04 13:14:59 +02:00
key
l2tp	genetlink: hold RCU in genlmsg_mcast()	2024-11-08 16:20:50 +01:00
l3mdev
lapb
llc	llc: call sock_orphan() at release time	2024-02-23 08:25:04 +01:00
mac80211	mac80211: always have ieee80211_sta_restart()	2024-11-08 16:20:54 +01:00
mac802154	net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()	2024-07-27 10:38:31 +02:00
mpls
ncsi	net/ncsi: Fix netlink major/minor version numbers	2024-01-25 14:34:25 -08:00
netfilter	netfilter: nft_payload: sanitize offset and length before calling skb_checksum()	2024-11-08 16:20:53 +01:00
netlabel
netlink	genetlink: hold RCU in genlmsg_mcast()	2024-11-08 16:20:50 +01:00
netrom	netrom: Fix a memory leak in nr_heartbeat_expiry()	2024-07-05 09:08:22 +02:00
nfc	nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()	2024-06-16 13:28:46 +02:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 11:43:49 +02:00
openvswitch	openvswitch: Set the skbuff pkt_type for proper pmtud support.	2024-06-16 13:28:45 +02:00
packet	af_packet: Handle outgoing VLAN packets without hardware offloading	2024-08-19 05:33:35 +02:00
phonet	phonet: fix rtm_phonet_notify() skb allocation	2024-05-17 11:43:54 +02:00
psample
qrtr	net: qrtr: Update packets cloning when broadcasting	2024-11-08 16:20:33 +01:00
rds	net:rds: Fix possible deadlock in rds_message_put	2024-09-04 13:15:03 +02:00
rfkill
rose
rxrpc	rxrpc: Fix response to PING RESPONSE ACKs to a dead call	2024-02-23 08:25:07 +01:00
sched	net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT	2024-11-08 16:20:52 +01:00
sctp	sctp: properly validate chunk size in sctp_sf_ootb()	2024-11-17 14:58:50 +01:00
smc	net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined	2024-08-19 05:33:28 +02:00
strparser
sunrpc	net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket	2024-09-12 11:03:57 +02:00
switchdev
tipc	tipc: guard against string buffer overrun	2024-11-08 16:20:37 +01:00
tls	tls: stop recv() if initial process_rx_list gave us non-DATA	2024-03-01 13:13:37 +01:00
unix	af_unix: Remove put_pid()/put_cred() in copy_peercred().	2024-09-12 11:03:52 +02:00
vmw_vsock	virtio/vsock: fix logic which reduces credit update messages	2024-01-25 14:34:25 -08:00
wimax
wireless	genetlink: hold RCU in genlmsg_mcast()	2024-11-08 16:20:50 +01:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:22:18 -04:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-06-16 13:28:52 +02:00
xfrm	xfrm: validate new SA's prefixlen using SA family when sel.family is unset	2024-11-08 16:20:52 +01:00
compat.c
Kconfig
Makefile
socket.c
sysctl_net.c