Marcelo Ricardo Leitner
a01745edc1
sctp: add size validation when walking chunks ...
[ Upstream commit 50619dbf8db77e98d821d615af4f634d08e22698 ]
The first chunk in a packet is ensured to be present at the beginning of
sctp_rcv(), as a packet needs to have at least 1 chunk. But the second
one, may not be completely available and ch->length can be over
uninitialized memory.
Fix here is by only trying to walk on the next chunk if there is enough to
hold at least the header, and then proceed with the ch->length validation
that is already there.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-19 08:53:13 +02:00
net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid
2020-11-05 11:43:20 +01:00
net: vlan: avoid leaks on register_vlan_dev() failures
2021-01-17 14:05:31 +01:00
appletalk: Fix skb allocation size in loopback case
2021-04-07 14:47:41 +02:00
batman-adv: Avoid WARN_ON timing related checks
2021-06-23 14:41:23 +02:00
Bluetooth: Shutdown controller after workqueues are flushed or cancelled
2021-07-19 08:53:13 +02:00
bpfilter: Specify the log level for the kmsg message
2021-07-14 16:53:33 +02:00
net: bridge: fix vlan tunnel dst refcnt when egressing
2021-06-23 14:41:30 +02:00
net: caif: fix memory leak in cfusbl_device_notify
2021-06-10 13:37:10 +02:00
can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done
2021-07-14 16:53:04 +02:00
libceph: clear con->out_msg on Policy::stateful_server faults
2020-11-05 11:43:34 +01:00
net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT
2021-07-19 08:53:08 +02:00
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
2021-01-23 15:57:59 +01:00
ipv6: weaken the v4mapped source check
2021-04-07 14:47:38 +02:00
net: dsa: fix error code getting shifted with 4 in dsa_slave_get_sset_count
2021-06-03 08:59:12 +02:00
hsr: use netdev_err() instead of WARN_ONCE()
2021-05-14 09:44:10 +02:00
net: ieee802154: fix null deref in parse dev addr
2021-06-18 09:58:57 +02:00
net: ip: avoid OOM kills with large UDP sends over loopback
2021-07-19 08:53:13 +02:00
net: ip: avoid OOM kills with large UDP sends over loopback
2021-07-19 08:53:13 +02:00
net/af_iucv: remove WARN_ONCE on malformed RX packets
2021-03-07 12:20:42 +01:00
af_key: relax availability checks for skb size calculation
2021-02-13 13:52:54 +01:00
net: lapb: Copy the skb before sending a packet
2021-02-10 09:25:28 +01:00
mac80211: remove iwlwifi specific workaround NDPs of null_response
2021-07-14 16:53:32 +02:00
net: mac802154: Fix general protection fault
2021-04-14 08:24:18 +02:00
net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0
2021-03-17 17:03:31 +01:00
net/ncsi: Avoid channel_monitor hrtimer deadlock
2021-04-14 08:24:15 +02:00
netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols
2021-07-14 16:53:30 +02:00
netlabel: Fix memory leak in netlbl_mgmt_add_common
2021-07-14 16:53:29 +02:00
netlink: disable IRQs for netlink_lock_table()
2021-06-16 11:59:34 +02:00
net/nfc/rawsock.c: fix a permission check bug
2021-06-16 11:59:33 +02:00
openvswitch: meter: fix race when getting now_ms.
2021-06-03 08:59:13 +02:00
net/packet: annotate accesses to po->ifindex
2021-06-30 08:47:48 -04:00
net: qrtr: fix OOB Read in qrtr_endpoint_post
2021-06-23 14:41:25 +02:00
net: rds: fix memory leak in rds_recvmsg
2021-06-23 14:41:24 +02:00
rfkill: Fix use-after-free in rfkill_resume()
2020-11-24 13:29:05 +01:00
rose: Fix Null pointer dereference in rose_send_frame()
2020-12-08 10:40:23 +01:00
rxrpc: Fix clearance of Tx/Rx ring when releasing a call
2021-02-17 10:35:18 +01:00
net: sched: fix error return code in tcf_del_walker()
2021-07-19 08:53:11 +02:00
sctp: add size validation when walking chunks
2021-07-19 08:53:13 +02:00
Revert "net/smc: fix a NULL pointer dereference"
2021-06-03 08:59:08 +02:00
SUNRPC: Should wake up the privileged task firstly.
2021-07-14 16:53:05 +02:00
net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP
2021-02-07 15:35:46 +01:00
tipc: fix unique bearer names sanity check
2021-06-10 13:37:08 +02:00
tls: prevent oversized sendfile() hangs by ignoring MSG_MORE
2021-07-14 16:53:31 +02:00
net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
2021-06-23 14:41:26 +02:00
vsock: notify server to shutdown when client has pending signal
2021-07-19 08:53:12 +02:00
wireless: wext-spy: Fix out-of-bounds warning
2021-07-19 08:53:12 +02:00
net/x25: Return the correct errno code
2021-06-18 09:59:00 +02:00
xsk: Simplify detection of empty and full rings
2021-05-22 11:38:27 +02:00
xfrm: Fix error reporting in xfrm_state_construct.
2021-07-19 08:53:11 +02:00
net: Return the correct errno code
2021-06-18 09:59:00 +02:00
net: make get_net_ns return error if NET_NS is disabled
2021-06-23 14:41:25 +02:00
a01745edc1