Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Kuniyuki Iwashima c19c094342 atm: atmtcp: Free invalid length skb in atmtcp_c_send(). ... [ Upstream commit 2f370ae1fb6317985f3497b1bb80d457508ca2f7 ] syzbot reported the splat below. [0] vcc_sendmsg() copies data passed from userspace to skb and passes it to vcc->dev->ops->send(). atmtcp_c_send() accesses skb->data as struct atmtcp_hdr after checking if skb->len is 0, but it's not enough. Also, when skb->len == 0, skb and sk (vcc) were leaked because dev_kfree_skb() is not called and sk_wmem_alloc adjustment is missing to revert atm_account_tx() in vcc_sendmsg(), which is expected to be done in atm_pop_raw(). Let's properly free skb with an invalid length in atmtcp_c_send(). [0]: BUG: KMSAN: uninit-value in atmtcp_c_send+0x255/0xed0 drivers/atm/atmtcp.c:294 atmtcp_c_send+0x255/0xed0 drivers/atm/atmtcp.c:294 vcc_sendmsg+0xd7c/0xff0 net/atm/common.c:644 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x330/0x3d0 net/socket.c:727 ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2566 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620 __sys_sendmsg net/socket.c:2652 [inline] __do_sys_sendmsg net/socket.c:2657 [inline] __se_sys_sendmsg net/socket.c:2655 [inline] __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2655 x64_sys_call+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4154 [inline] slab_alloc_node mm/slub.c:4197 [inline] kmem_cache_alloc_node_noprof+0x818/0xf00 mm/slub.c:4249 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:579 __alloc_skb+0x347/0x7d0 net/core/skbuff.c:670 alloc_skb include/linux/skbuff.h:1336 [inline] vcc_sendmsg+0xb40/0xff0 net/atm/common.c:628 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x330/0x3d0 net/socket.c:727 ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2566 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620 __sys_sendmsg net/socket.c:2652 [inline] __do_sys_sendmsg net/socket.c:2657 [inline] __se_sys_sendmsg net/socket.c:2655 [inline] __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2655 x64_sys_call+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 5798 Comm: syz-executor192 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(undef) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Reported-by: syzbot+1d3c235276f62963e93a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1d3c235276f62963e93a Tested-by: syzbot+1d3c235276f62963e93a@syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20250616182147.963333-2-kuni1840@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-06-27 11:02:57 +01:00
..
accessibility
acpi	ACPI: battery: negate current when discharging	2025-06-27 11:02:53 +01:00
amba
android	binder: fix UAF caused by offsets overwrite	2024-09-12 11:03:55 +02:00
ata	ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330	2025-06-27 11:02:51 +01:00
atm	atm: atmtcp: Free invalid length skb in atmtcp_c_send().	2025-06-27 11:02:57 +01:00
auxdisplay
base	PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()	2025-06-27 11:02:53 +01:00
bcma
block	aoe: clean device rq_list in aoedev_downdev()	2025-06-27 11:02:57 +01:00
bluetooth	Bluetooth: btrtl: Prevent potential NULL dereference	2025-05-02 07:39:19 +02:00
bus	Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"	2025-06-27 11:02:55 +01:00
cdrom
char	virtio_console: fix missing byte order handling for cols and rows	2025-05-02 07:39:26 +02:00
clk	clk: rockchip: rk3036: mark ddrphy as critical	2025-06-27 11:02:55 +01:00
clocksource	clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()	2025-06-04 14:32:29 +02:00
connector
counter	counter: stm32-lptimer-cnt: fix error handling when enabling	2025-04-10 14:29:39 +02:00
cpufreq	cpufreq: Force sync policy boost with global boost on sysfs update	2025-06-27 11:02:54 +01:00
cpuidle	cpuidle: menu: Avoid discarding useful information	2025-06-04 14:32:32 +02:00
crypto	crypto: marvell/cesa - Avoid empty transfer descriptor	2025-06-27 11:02:45 +01:00
dax
dca
devfreq
dio
dma	dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"	2025-06-04 14:32:29 +02:00
dma-buf	udmabuf: fix a buf size overflow issue during udmabuf creation	2025-05-02 07:39:29 +02:00
edac	EDAC/altera: Use correct write width with the INTTEST register	2025-06-27 11:02:51 +01:00
eisa
extcon
firewire
firmware	firmware: psci: Fix refcount leak in psci_dt_init	2025-06-27 11:02:46 +01:00
fpga	fpga: altera-cvp: Increase credit timeout	2025-06-04 14:32:32 +02:00
fsi
gnss
gpio	gpio: zynq: Fix wakeup source leaks on device unbind	2025-05-02 07:39:17 +02:00
gpu	drm/nouveau/bl: increase buffer size to avoid truncate warning	2025-06-27 11:02:57 +01:00
greybus
hid	HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()	2025-06-27 11:02:56 +01:00
hsi	HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition	2025-05-02 07:39:18 +02:00
hv	Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()	2025-04-10 14:29:35 +02:00
hwmon	hwmon: (occ) fix unaligned accesses	2025-06-27 11:02:57 +01:00
hwspinlock
hwtracing	coresight: catu: Fix number of pages while using 64k pages	2025-04-10 14:29:41 +02:00
i2c	i2c: designware: Invoke runtime suspend on quick slave re-registration	2025-06-27 11:02:54 +01:00
i3c	i3c: Add NULL pointer check in i3c_master_queue_ibi()	2025-05-02 07:39:15 +02:00
ide
idle
iio	iio: adc: ad7606_spi: fix reg write value mask	2025-06-27 11:02:52 +01:00
infiniband	RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h	2025-06-27 11:02:46 +01:00
input	Input: sparcspkr - avoid unannotated fall-through	2025-06-27 11:02:56 +01:00
interconnect
iommu	iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid	2025-06-04 14:32:26 +02:00
ipack
irqchip	irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()	2025-06-04 14:32:25 +02:00
isdn
leds	leds: lp8860: Write full EEPROM, not only half of it	2025-03-13 12:43:06 +01:00
lightnvm
macintosh
mailbox	mailbox: use error ret code of of_parse_phandle_with_args()	2025-06-04 14:32:30 +02:00
mcb	mcb: fix a double free bug in chameleon_parse_gdd()	2025-05-02 07:39:26 +02:00
md	dm-mirror: fix a tiny race condition	2025-06-27 11:02:52 +01:00
media	media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()	2025-06-27 11:02:54 +01:00
memory
memstick	memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove	2025-04-10 14:29:39 +02:00
message	scsi: fusion: Remove unused variable 'rc'	2024-12-14 19:44:29 +01:00
mfd	mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE	2025-06-27 11:02:48 +01:00
misc	misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error	2025-05-02 07:39:25 +02:00
mmc	mmc: sdhci: Disable SD card clock before changing parameters	2025-06-04 14:32:31 +02:00
mtd	mtd: nand: sunxi: Add randomizer configuration before randomizer enable	2025-06-27 11:02:52 +01:00
mux
net	wifi: carl9170: do not ping device which has failed to load firmware	2025-06-27 11:02:57 +01:00
nfc
ntb	ntb: reduce stack usage in idt_scan_mws	2025-05-02 07:39:28 +02:00
nubus
nvdimm	libnvdimm/labels: Fix divide error in nd_label_data_init()	2025-06-04 14:32:30 +02:00
nvme	nvmet-tcp: don't restore null sk_state_change	2025-06-04 14:32:35 +02:00
nvmem	nvmem: core: improve range check for nvmem_cell_write()	2025-03-13 12:43:10 +01:00
of	of: module: add buffer overflow check in of_modalias()	2025-06-04 14:32:25 +02:00
opp
oprofile
parisc
parport	parport_pc: add support for ASIX AX99100	2025-03-13 12:43:19 +01:00
pci	PCI: Fix lock symmetry in pci_slot_unlock()	2025-06-27 11:02:52 +01:00
pcmcia
perf	perf: arm_pmu: Don't disable counter in armpmu_add()	2025-05-02 07:39:09 +02:00
phy	phy: core: don't require set_mode() callback for phy_get_mode() to work	2025-06-04 14:32:33 +02:00
pinctrl	pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()	2025-06-27 11:02:55 +01:00
platform	platform/x86: dell_rbu: Stop overwriting data buffer	2025-06-27 11:02:56 +01:00
pnp
power	power: supply: bq27xxx: Retrieve again when busy	2025-06-27 11:02:53 +01:00
powercap	powercap: call put_device() on an error path in powercap_register_control_type()	2025-04-10 14:29:36 +02:00
pps	pps: Fix a use-after-free	2025-03-13 12:43:19 +01:00
ps3
ptp	ptp: Ensure info->enable callback is always set	2025-03-13 12:43:11 +01:00
pwm	pwm: mediatek: always use bus clock for PWM on MT7622	2025-05-02 07:39:18 +02:00
rapidio	drivers/rapidio/rio_cm.c: prevent possible heap overwrite	2025-06-27 11:02:56 +01:00
ras
regulator	regulator: max14577: Add error check for max14577_read_reg()	2025-06-27 11:02:52 +01:00
remoteproc
reset	reset: berlin: fix OF node leak in probe() error path	2024-11-08 16:20:28 +01:00
rpmsg	rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()	2025-06-27 11:02:48 +01:00
rtc	rtc: Fix offset calculation for .start_secs < 0	2025-06-27 11:02:48 +01:00
s390	scsi: s390: zfcp: Ensure synchronous unit_add	2025-06-27 11:02:56 +01:00
sbus
scsi	scsi: storvsc: Increase the timeouts to storvsc_timeout	2025-06-27 11:02:56 +01:00
sfi
sh	sh: clk: Fix clk_enable() to return 0 on NULL clk	2025-01-09 13:23:29 +01:00
siox
slimbus	slimbus: messaging: Free transaction ID in delayed interrupt scenario	2025-03-13 12:43:33 +01:00
soc	soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()	2025-06-27 11:02:48 +01:00
soundwire	soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"	2024-11-08 16:20:25 +01:00
spi	spi: sh-msiof: Fix maximum DMA transfer size	2025-06-27 11:02:45 +01:00
spmi
ssb
staging	staging: iio: ad5933: Correct settling cycles encoding per datasheet	2025-06-27 11:02:52 +01:00
target	scsi: target: iscsi: Fix timeout on deleted connection	2025-06-04 14:32:29 +02:00
tc
tee	tee: Prevent size calculation wraparound on 32-bit kernels	2025-06-27 11:02:55 +01:00
thermal	thermal/drivers/rockchip: Add missing rk3328 mapping entry	2025-05-02 07:39:16 +02:00
thunderbolt	thunderbolt: Do not double dequeue a configuration request	2025-06-27 11:02:44 +01:00
tty	vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()	2025-06-27 11:02:48 +01:00
uio	uio_hv_generic: Use correct size for interrupt and monitor pages	2025-06-27 11:02:52 +01:00
usb	HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()	2025-06-27 11:02:56 +01:00
vfio	vfio/pci: Enable iowrite64 and ioread64 for vfio pci	2025-03-13 12:43:13 +01:00
vhost
video	vgacon: Add check for vc_origin address range in vgacon_scroll()	2025-06-27 11:02:51 +01:00
virt
virtio
visorbus
vlynq
vme
w1
watchdog	watchdog: da9052_wdt: respect TWDMIN	2025-06-27 11:02:55 +01:00
xen	xen/swiotlb: relax alignment requirements	2025-06-04 14:32:37 +02:00
zorro
Kconfig
Makefile