Nate Karstens
af5a7f06b6
strparser: Fix signed/unsigned mismatch bug ...
commit 4da4e4bde1c453ac5cc2dce5def81d504ae257ee upstream.
The `len` member of the sk_buff is an unsigned int. This is cast to
`ssize_t` (a signed type) for the first sk_buff in the comparison,
but not the second sk_buff. On 32-bit systems, this can result in
an integer underflow for certain values because unsigned arithmetic
is being used.
This appears to be an oversight: if the intention was to use unsigned
arithmetic, then the first cast would have been omitted. The change
ensures both len values are cast to `ssize_t`.
The underflow causes an issue with ktls when multiple TLS PDUs are
included in a single TCP segment. The mainline kernel does not use
strparser for ktls anymore, but this is still useful for other
features that still use strparser, and for backporting.
Signed-off-by: Nate Karstens <nate.karstens@garmin.com>
Cc: stable@vger.kernel.org
Fixes: 43a0c6751ahttps://patch.msgid.link/20251106222835.1871628-1-nate.karstens@garmin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-12-03 12:45:19 +01:00
net/9p: fix double req put in p9_fd_cancelled
2025-10-29 13:59:54 +01:00
net: vlan: sync VLAN features with lower device
2025-12-03 12:45:15 +01:00
net: appletalk: Fix use-after-free in AARP proxy probe
2025-08-28 16:21:17 +02:00
net: atm: fix memory leak in atm_register_sysfs when device_register fail
2025-09-09 18:43:58 +02:00
ax25: properly unshare skbs in ax25_kiss_rcv()
2025-09-09 18:43:58 +02:00
batman-adv: fix OOB read/write in network-coding decode
2025-09-09 18:43:59 +02:00
Bluetooth: L2CAP: export l2cap_chan_hold for modules
2025-12-03 12:45:18 +01:00
bpfilter: match bit size of bpfilter_umh to that of the kernel
2025-07-17 18:24:51 +02:00
bridge: Redirect to backup port when port is administratively down
2025-12-03 12:45:09 +01:00
caif: reduce stack size, again
2025-08-28 16:21:19 +02:00
can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
2025-10-02 13:34:29 +02:00
page_pool: Clamp pool size to max 16K pages
2025-12-03 12:45:14 +01:00
net: dsa: microchip: linearize skb for tail-tagging switches
2025-09-09 18:44:00 +02:00
net: When removing nexthops, don't call synchronize_net if it is not necessary
2025-12-03 12:45:10 +01:00
ipv6: np->rxpmtu race annotation
2025-12-03 12:45:13 +01:00
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
2025-06-04 14:32:35 +02:00
wifi: mac80211: skip rate verification for not captured PSDUs
2025-12-03 12:45:17 +01:00
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
2025-06-27 11:02:57 +01:00
net: ncsi: Fix buffer overflow in fetching version id
2025-08-28 16:21:27 +02:00
ipvs: Defer ip_vs_ftp unregister during netns cleanup
2025-10-29 13:59:49 +01:00
calipso: unlock rcu before returning -EAFNOSUPPORT
2025-06-27 11:02:50 +01:00
netlink: avoid infinite retry looping in netlink_unicast()
2025-08-28 16:21:23 +02:00
NFC: nci: uart: Set tty->disc_data only in success path
2025-06-27 11:02:51 +01:00
openvswitch: Fix unsafe attribute parsing in output_userspace()
2025-06-04 14:32:29 +02:00
net/packet: fix a race in packet_set_ring() and packet_notifier()
2025-08-28 16:21:23 +02:00
phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
2025-08-28 16:21:14 +02:00
rds: Fix endianness annotation for RDS_MPATH_HASH
2025-12-03 12:45:10 +01:00
net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
2025-10-02 13:34:32 +02:00
rose: fix dangling neighbour pointers in rose_rt_device_down()
2025-07-17 18:25:00 +02:00
rxrpc: Fix oops due to non-existence of prealloc backlog struct
2025-07-17 18:25:02 +02:00
net_sched: limit try_bulk_dequeue_skb() batches
2025-12-03 12:45:18 +01:00
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
2025-12-03 12:45:17 +01:00
strparser: Fix signed/unsigned mismatch bug
2025-12-03 12:45:19 +01:00
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
2025-06-27 11:02:58 +01:00
tipc: Fix use-after-free in tipc_mon_reinit_self().
2025-12-03 12:45:17 +01:00
tls: don't rely on tx_work during send()
2025-10-29 13:59:57 +01:00
vsock: Do not allow binding to VMADDR_PORT_ANY
2025-08-28 16:21:23 +02:00
wifi: cfg80211: fix use-after-free in cmp_bss()
2025-09-09 18:43:56 +02:00
xfrm: Sanitize marks before insert
2025-06-04 14:32:35 +02:00
af5a7f06b6