No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Jon Maloy d692e3406e tipc: improve size validations for received domain records
commit 9aa422ad326634b76309e8ff342c246800621216 upstream.

The function tipc_mon_rcv() allows a node to receive and process
domain_record structs from peer nodes to track their views of the
network topology.

This patch verifies that the number of members in a received domain
record does not exceed the limit defined by MAX_MON_DOMAIN, something
that may otherwise lead to a stack overflow.

tipc_mon_rcv() is called from the function tipc_link_proto_rcv(), where
we are reading a 32 bit message data length field into a uint16.  To
avert any risk of bit overflow, we add an extra sanity check for this in
that function.  We cannot see that happen with the current code, but
future designers being unaware of this risk, may introduce it by
allowing delivery of very large (> 64k) sk buffers from the bearer
layer.  This potential problem was identified by Eric Dumazet.

This fixes CVE-2022-0435

Reported-by: Samuel Page <samuel.page@appgate.com>
Reported-by: Eric Dumazet <edumazet@google.com>
Fixes: 35c55c9877 ("tipc: add neighbor monitoring framework")
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Samuel Page <samuel.page@appgate.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-11 09:07:52 +01:00
arch powerpc/32: Fix boot failure with GCC latent entropy plugin 2022-02-01 17:24:36 +01:00
block block: bio-integrity: Advance seed correctly for larger interval sizes 2022-02-08 18:24:28 +01:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-15 09:47:29 +02:00
crypto crypto: pcrypt - Delay write to padata->info 2021-11-17 09:48:40 +01:00
Documentation psi: Fix uaf issue when psi trigger is destroyed while being polled 2022-02-05 12:35:36 +01:00
drivers moxart: fix potential use-after-free on remove path 2022-02-11 09:07:51 +01:00
fs ext4: fix error handling in ext4_restore_inline_data() 2022-02-08 18:24:34 +01:00
include psi: Fix uaf issue when psi trigger is destroyed while being polled 2022-02-05 12:35:36 +01:00
init
ipc shm: extend forced shm destroy to support objects from several IPC nses 2021-12-01 09:23:35 +01:00
kernel cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning 2022-02-08 18:24:35 +01:00
lib lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test 2022-01-27 09:19:55 +01:00
LICENSES
mm mm/kmemleak: avoid scanning potential huge holes 2022-02-08 18:24:28 +01:00
net tipc: improve size validations for received domain records 2022-02-11 09:07:52 +01:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-17 09:48:39 +01:00
scripts scripts/dtc: dtx_diff: remove broken example from help text 2022-01-27 09:19:55 +01:00
security selinux: fix potential memleak in selinux_add_opt() 2022-01-27 09:19:35 +01:00
sound ASoC: max9759: fix underflow in speaker_gain_control_put() 2022-02-08 18:24:33 +01:00
tools selftests: futex: Use variable MAKE instead of make 2022-02-08 18:24:34 +01:00
usr
virt KVM: do not shrink halt_poll_ns below grow_start 2021-10-09 14:39:50 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.178 2022-02-08 18:24:35 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.