mirror of
https://github.com/torvalds/linux.git
synced 2026-10-23 15:32:04 +02:00
0923198be4
`put()` trusted an unchecked `as` cast from `usize` to `c_int`.
When the length exceeds `i32::MAX` that cast wraps around to a
negative value.
This ultimately resulted in a kernel panic when the reinterpreted
value via `__nla_reserve()` and `skb_put()` became enormous.
Validate payload and header both fit together in a `u16`, rejecting
any payload that wouldn't leave room for `NLA_HDRLEN`.
Fixes:
|
||
|---|---|---|
| .. | ||
| bindings | ||
| helpers | ||
| kernel | ||
| macros | ||
| pin-init | ||
| proc-macro2 | ||
| quote | ||
| syn | ||
| uapi | ||
| zerocopy | ||
| zerocopy-derive | ||
| .gitignore | ||
| .kunitconfig | ||
| bindgen_parameters | ||
| build_error.rs | ||
| compiler_builtins.rs | ||
| exports.c | ||
| ffi.rs | ||
| Makefile | ||