No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Andrey Shvetsov b5e5d81230 staging: most: net: fix buffer overflow
commit 4d1356ac12f4d5180d0df345d85ff0ee42b89c72 upstream.

If the length of the socket buffer is 0xFFFFFFFF (max size for an
unsigned int), then payload_len becomes 0xFFFFFFF1 after subtracting 14
(ETH_HLEN).  Then, mdp_len is set to payload_len + 16 (MDP_HDR_LEN)
which overflows and results in a value of 2.  These values for
payload_len and mdp_len will pass current buffer size checks.

This patch checks if derived from skb->len sum may overflow.

The check is based on the following idea:

For any `unsigned V1, V2` and derived `unsigned SUM = V1 + V2`,
`V1 + V2` overflows iif `SUM < V1`.

Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrey Shvetsov <andrey.shvetsov@k2l.de>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200116172238.6046-1-andrey.shvetsov@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-01 09:34:33 +00:00
arch powerpc/xive: Discard ESB load value when interrupt is invalid 2020-01-29 16:45:26 +01:00
block block: fix memleak of bio integrity data 2020-01-26 10:01:09 +01:00
certs
crypto crypto: algif_skcipher - Use chunksize instead of blocksize 2020-01-17 19:48:46 +01:00
Documentation hwrng: omap3-rom - Fix missing clock by probing with device tree 2020-01-26 10:01:03 +01:00
drivers staging: most: net: fix buffer overflow 2020-02-01 09:34:33 +00:00
fs readdir: be more conservative with directory entry names 2020-01-29 16:45:31 +01:00
include USB: serial: ir-usb: fix link-speed handling 2020-02-01 09:34:32 +00:00
init mm, debug_pagealloc: don't rely on static keys too early 2020-01-23 08:22:40 +01:00
ipc
kernel tracing: Fix histogram code when expression has same var as value 2020-01-29 16:45:26 +01:00
lib lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user() 2020-01-29 16:45:29 +01:00
LICENSES
mm mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio() 2020-01-23 08:22:41 +01:00
net net/x25: fix nonblocking connect 2020-01-29 16:45:33 +01:00
samples samples/bpf: Fix broken xdp_rxq_info due to map order assumptions 2020-01-26 10:00:58 +01:00
scripts ARM: 8950/1: ftrace/recordmcount: filter relocation types 2020-01-29 16:45:27 +01:00
security tomoyo: Suppress RCU warning at list_for_each_entry_rcu(). 2020-01-17 19:49:05 +01:00
sound ALSA: usb-audio: fix sync-ep altsetting sanity check 2020-01-23 08:22:31 +01:00
tools kselftests: cgroup: Avoid the reuse of fd after it is deallocated 2020-01-26 10:01:07 +01:00
usr gen_initramfs_list.sh: fix 'bad variable name' error 2020-01-09 10:20:00 +01:00
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS MAINTAINERS: Append missed file to the database 2020-01-17 19:48:28 +01:00
Makefile Linux 5.4.16 2020-01-29 16:45:34 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.