No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Daniel Starke b229bc6c6e tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
commit 47388e807f85948eefc403a8a5fdc5b406a65d5a upstream.

Assuming the following:
- side A configures the n_gsm in basic option mode
- side B sends the header of a basic option mode frame with data length 1
- side A switches to advanced option mode
- side B sends 2 data bytes which exceeds gsm->len
  Reason: gsm->len is not used in advanced option mode.
- side A switches to basic option mode
- side B keeps sending until gsm0_receive() writes past gsm->buf
  Reason: Neither gsm->state nor gsm->len have been reset after
  reconfiguration.

Fix this by changing gsm->count to gsm->len comparison from equal to less
than. Also add upper limit checks against the constant MAX_MRU in
gsm0_receive() and gsm1_receive() to harden against memory corruption of
gsm->len and gsm->mru.

All other checks remain as we still need to limit the data according to the
user configuration and actual payload size.

Reported-by: j51569436@gmail.com
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218708
Tested-by: j51569436@gmail.com
Fixes: e1eaea46bb ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20240424054842.7741-1-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-16 13:28:30 +02:00
arch x86/tsc: Trust initial offset in architectural TSC-adjust MSRs 2024-06-16 13:28:30 +02:00
block block: prevent division by zero in blk_rq_stat_sum() 2024-04-13 12:51:38 +02:00
certs
crypto Revert "crypto: api - Disallow identical driver names" 2024-05-02 16:18:35 +02:00
Documentation docs: kernel_include.py: Cope with docutils 0.21 2024-05-25 16:17:18 +02:00
drivers tty: n_gsm: fix possible out-of-bounds in gsm0_receive() 2024-06-16 13:28:30 +02:00
fs btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() 2024-05-25 16:17:18 +02:00
include xfrm: Preserve vlan tags for transport mode software GRO 2024-05-17 11:43:53 +02:00
init init: open /initrd.image with O_LARGEFILE 2024-04-13 12:51:36 +02:00
ipc
kernel bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS 2024-05-02 16:18:37 +02:00
lib dyndbg: fix old BUG_ON in >control parser 2024-05-17 11:43:55 +02:00
LICENSES
mm x86/mm/pat: fix VM_PAT handling in COW mappings 2024-04-13 12:51:40 +02:00
net net: fix out-of-bounds access in ops_init 2024-05-17 11:43:55 +02:00
samples media: rename VFL_TYPE_GRABBER to _VIDEO 2024-03-26 18:22:22 -04:00
scripts kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 2024-04-13 12:51:26 +02:00
security smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity() 2024-04-13 12:51:22 +02:00
sound ALSA: line6: Zero-initialize message buffers 2024-05-17 11:43:51 +02:00
tools Revert "selftests: mm: fix map_hugetlb failure on 64K page size systems" 2024-05-25 16:17:17 +02:00
usr
virt KVM: async_pf: Cleanup kvm_setup_async_pf() 2024-05-02 16:18:32 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS iio: stx104: Move to addac subdirectory 2023-08-30 16:27:12 +02:00
Makefile Linux 5.4.277 2024-05-25 16:17:18 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.