Sungmin Kang ee7f9bb932 net: slip: serialize receive against buffer reallocation ... sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through rbuff without holding the lock. An MTU change can therefore race with receive processing. An MTU shrink can expose the new smaller rbuff with the old larger bound, causing an out-of-bounds write. A receive callback which already loaded the old rbuff can instead continue writing after that buffer has been freed. Serialize receive processing with sl_realloc_bufs() by holding sl->lock while consuming each receive batch. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Sungmin Kang <726ksm@gmail.com> Link: https://patch.msgid.link/20260718073631.1674-1-726ksm@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-07-23 09:06:48 -07:00
..
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile
slhc.c	slip: bound decode() reads against the compressed packet length	2026-04-21 10:18:18 +02:00
slip.c	net: slip: serialize receive against buffer reallocation	2026-07-23 09:06:48 -07:00
slip.h	slip: fix macro redefine warning	2021-11-23 11:38:13 +00:00