github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 10:09:10 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Here is a batman-adv bugfix:

Browse Source 
- fix OOB read/write in network-coding decode, by Stanislav Fort
 -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCgA0FiEE1ilQI7G+y+fdhnrfoSvjmEKSnqEFAmi1xYQWHHN3QHNpbW9u
 d3VuZGVybGljaC5kZQAKCRChK+OYQpKeofikEAC4zwAp6jH3/buiQ5+y08JtO0+m
 HyfbN/Z8slGluJElQQjw1ANiXRxTQ5ZQnEtsL7svIOT6pnDYaoF0dEWuOh15/wXj
 8W8Dc5IKBzee/ZYAmlGIg1VxIYvWksOxz5y/Y1KkxjyERihGXyW40Z34CnXuAXfC
 Vvjz08i++qYC1SxsUEI+Wm6WVWabPG4OUR+eyW6AAv3H69B3Xucq2xmfLTVrTm+P
 wqobwD1aultD6DjVLXkJS5XpdmpO3zTQvqPlQp6uPu3SCv8eXr9c7p95EHeJpxAG
 TFoFDgHMPkTh5VAL9BNhRiuiB2CnsfNu4Ylx0KRCSAH8NsZunckeM1Gi6FIcjAwW
 JC/VxHoPGYOkcIN+Ton8K25trernIs3oPeK1q9+Pq0I8NwMgeMKSB6EpBRcN0kGp
 Q7af8QVubk7rczLTEz1F3khU03JPUJ3uS/0QFkVfeVl1Lh8XcYXgLBQzP7Mq4eKn
 +sgDrq+GcrkxKAEylY0cT7D/BDASvITiY9dJAWDqFyXMMizH0mI96aPWCBDwqTkI
 YSR+V639M/3a5C647tgQNwfqhl+jghva2o0vChYGOral2wHOtDeLCwWH210NAT28
 kkp6FGkM9TlF9nm33TIeXerVuauWSQqnRcL/JfEqlHUYvx4h8V/4O918iEDCUS4K
 xL6C8+kuIXnI8Tda9w==
 =edHS
 -----END PGP SIGNATURE-----

Merge tag 'batadv-net-pullrequest-20250901' of https://git.open-mesh.org/linux-merge

Simon Wunderlich says:

====================
Here is a batman-adv bugfix:

 - fix OOB read/write in network-coding decode, by Stanislav Fort

* tag 'batadv-net-pullrequest-20250901' of https://git.open-mesh.org/linux-merge:
  batman-adv: fix OOB read/write in network-coding decode
====================

Link: https://patch.msgid.link/
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2025-09-01 13:35:36 -07:00
commit aca701c618
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
net/batman-adv/network-coding.c
View File

@ -1687,7 +1687,12 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
coding_len = ntohs(coded_packet_tmp.coded_len);
if (coding_len > skb->len)
/* ensure dst buffer is large enough (payload only) */
if (coding_len + h_size > skb->len)
return NULL;
/* ensure src buffer is large enough (payload only) */
if (coding_len + h_size > nc_packet->skb->len)
return NULL;
/* Here the magic is reversed: