superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mirror-linux/net/batman-adv
History
Stanislav Fort d77b6ff0ce batman-adv: fix OOB read/write in network-coding decode 
batadv_nc_skb_decode_packet() trusts coded_len and checks only against
skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing
payload headroom, and the source skb length is not verified, allowing an
out-of-bounds read and a small out-of-bounds write.

Validate that coded_len fits within the payload area of both destination
and source sk_buffs before XORing.

Fixes: 2df5278b02 ("batman-adv: network coding - receive coded packets and decode them")
Cc: stable@vger.kernel.org
Reported-by: Stanislav Fort <disclosure@aisle.com>
Signed-off-by: Stanislav Fort <stanislav.fort@aisle.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
 		2025-08-31 17:01:35 +02:00
..
Kconfig lib/crc: remove CONFIG_LIBCRC32C 2025-04-04 11:31:42 -07:00
Makefile batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
bat_algo.c batman-adv: store hard_iface as iflink private data 2025-05-31 10:41:11 +02:00
bat_algo.h batman-adv: store hard_iface as iflink private data 2025-05-31 10:41:11 +02:00
bat_iv_ogm.c batman-adv: store hard_iface as iflink private data 2025-05-31 10:41:11 +02:00
bat_iv_ogm.h
…
bat_v.c batman-adv: store hard_iface as iflink private data 2025-05-31 10:41:11 +02:00
bat_v.h
…
bat_v_elp.c batman-adv: store hard_iface as iflink private data 2025-05-31 10:41:11 +02:00
bat_v_elp.h batman-adv: Drop unmanaged ELP metric worker 2025-01-22 21:46:42 +01:00
bat_v_ogm.c batman-adv: store hard_iface as iflink private data 2025-05-31 10:41:11 +02:00
bat_v_ogm.h
…
bitarray.c batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
bitarray.h
…
bridge_loop_avoidance.c batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
bridge_loop_avoidance.h batman-adv: Remove the repeated declaration 2021-05-30 13:38:27 +02:00
distributed-arp-table.c batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
distributed-arp-table.h batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
fragmentation.c batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
fragmentation.h
…
gateway_client.c batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
gateway_client.h batman-adv: Check ptr for NULL before reducing its refcnt 2021-08-08 20:21:40 +02:00
gateway_common.c batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
gateway_common.h batman-adv: Drop per algo GW section class code 2023-08-14 18:01:21 +02:00
hard-interface.c batman-adv: store hard_iface as iflink private data 2025-05-31 10:41:11 +02:00
hard-interface.h batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
hash.c
…
hash.h batman-adv: Fix spelling mistakes 2021-06-02 08:46:03 +02:00
log.c batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
log.h batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
main.c batman-adv: store hard_iface as iflink private data 2025-05-31 10:41:11 +02:00
main.h batman-adv: Start new development cycle 2025-05-31 10:37:44 +02:00
mesh-interface.c batman-adv: store hard_iface as iflink private data 2025-05-31 10:41:11 +02:00
mesh-interface.h batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
multicast.c batman-adv: store hard_iface as iflink private data 2025-05-31 10:41:11 +02:00
multicast.h batman-adv: mcast: implement multicast packet generation 2023-11-14 08:16:34 +01:00
multicast_forw.c batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
netlink.c batman-adv: store hard_iface as iflink private data 2025-05-31 10:41:11 +02:00
netlink.h batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
network-coding.c batman-adv: fix OOB read/write in network-coding decode 2025-08-31 17:01:35 +02:00
network-coding.h
…
originator.c batman-adv: store hard_iface as iflink private data 2025-05-31 10:41:11 +02:00
originator.h batman-adv: mcast: implement multicast packet reception and forwarding 2023-11-14 08:16:34 +01:00
routing.c batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
routing.h batman-adv: mcast: implement multicast packet reception and forwarding 2023-11-14 08:16:34 +01:00
send.c batman-adv: store hard_iface as iflink private data 2025-05-31 10:41:11 +02:00
send.h batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
tp_meter.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
tp_meter.h
…
trace.c
…
trace.h batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
translation-table.c batman-adv: Switch to crc32 header for crc32c 2025-04-13 11:11:31 +02:00
translation-table.h batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
tvlv.c batman-adv: Use consistent name for mesh interface 2025-02-22 11:36:22 +01:00
tvlv.h batman-adv: tvlv: prepare for tvlv enabled multicast packet type 2023-01-21 19:01:59 +01:00
types.h batman-adv: Switch to bitmap helper for aggregation handling 2025-02-22 11:36:25 +01:00