Pavel Skripkin ffc9019bd9 Bluetooth: stop proccessing malicious adv data ... [ Upstream commit 3a56ef719f ] Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The problem was in missing validaion check. We should check if data is not malicious and we can read next data block. If we won't check ptr validness, code can read a way beyond skb->end and it can cause problems, of course. Fixes: e95beb4141 ("Bluetooth: hci_le_adv_report_evt code refactoring") Reported-and-tested-by: syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-01-27 10:53:48 +01:00
..
6lowpan	6lowpan: iphc: Fix an off-by-one check of array index	2021-09-15 09:50:34 +02:00
9p	9p/net: fix missing error check in p9_check_errors	2021-11-18 14:04:29 +01:00
802
8021q	net: vlan: fix underflow for the real_dev refcnt	2021-12-01 09:19:08 +01:00
appletalk
atm
ax25	ax25: NPD bug when detaching AX25 device	2021-12-29 12:26:07 +01:00
batman-adv	batman-adv: mcast: don't send link-local multicast to mcast routers	2022-01-11 15:25:00 +01:00
bluetooth	Bluetooth: stop proccessing malicious adv data	2022-01-27 10:53:48 +01:00
bpf	bpf, test, cgroup: Use sk_{alloc,free} for test cases	2021-10-27 09:56:56 +02:00
bpfilter
bridge	net: bridge: mcast: use multicast_membership_interval for IGMPv3	2021-10-27 09:56:54 +02:00
caif	net-caif: avoid user-triggerable WARN_ON(1)	2021-09-22 12:27:56 +02:00
can	can: isotp: convert struct tpcon::{idx,len} to unsigned int	2022-01-16 09:14:23 +01:00
ceph
core	lwtunnel: Validate RTA_ENCAP_TYPE attribute length	2022-01-11 15:25:00 +01:00
dcb
dccp	tcp: switch orphan_count to bare per-cpu counters	2021-11-18 14:04:08 +01:00
decnet
dns_resolver
dsa	net: dsa: don't allocate the slave_mii_bus using devres	2021-09-30 10:11:02 +02:00
ethernet
ethtool	ethtool: do not perform operations on net devices being unregistered	2021-12-17 10:14:41 +01:00
hsr
ieee802154
ife
ipv4	net: udp: fix alignment problem in udp4_seq_show()	2022-01-11 15:25:02 +01:00
ipv6	ipv6: raw: check passed optlen before reading	2022-01-11 15:25:02 +01:00
iucv
kcm
key
l2tp	net/l2tp: Fix reference count leak in l2tp_udp_recv_core	2021-09-22 12:27:56 +02:00
l3mdev
lapb
llc
mac80211	mac80211: initialize variable have_higher_than_11mbit	2022-01-11 15:24:59 +01:00
mac802154
mpls	net: mpls: Fix notifications when deleting a device	2021-12-08 09:03:23 +01:00
mptcp	mptcp: clear 'kern' flag from fallback sockets	2021-12-22 09:30:54 +01:00
ncsi	net/ncsi: check for error return from call to nla_put_u32	2022-01-05 12:40:32 +01:00
netfilter	netfilter: fix regression in looped (broad|multi)cast's MAC handling	2021-12-29 12:25:55 +01:00
netlabel	net: fix NULL pointer reference in cipso_v4_doi_free	2021-09-18 13:40:35 +02:00
netlink	net: netlink: af_netlink: Prevent empty skb by adding a check on len.	2021-12-17 10:14:40 +01:00
netrom	netrom: fix copying in user data in nr_setsockopt	2022-01-11 15:24:59 +01:00
nfc	nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()	2022-01-27 10:53:41 +01:00
nsh
openvswitch
packet	net/packet: rx_owner_map depends on pg_vec	2021-12-22 09:30:55 +01:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 15:25:01 +01:00
psample
qrtr
rds	rds: memory leak in __rds_conn_create()	2021-12-22 09:30:54 +01:00
rfkill
rose
rxrpc	rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()	2021-12-08 09:03:25 +01:00
sched	sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc	2022-01-11 15:25:00 +01:00
sctp	sctp: use call_rcu to free endpoint	2022-01-05 12:40:30 +01:00
smc	net/smc: fix kernel panic caused by race of smc_sock	2022-01-05 12:40:31 +01:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-18 14:04:27 +01:00
sunrpc	SUNRPC: Partial revert of commit 6f9f17287e	2021-11-18 14:04:32 +01:00
switchdev
tipc	tipc: check for null after calling kmemdup	2021-11-26 10:39:19 +01:00
tls	net/tls: Fix authentication failure in CCM mode	2021-12-08 09:03:29 +01:00
unix	af_unix: fix races in sk_peer_pid and sk_peer_cred accesses	2021-10-06 15:55:58 +02:00
vmw_vsock	virtio/vsock: fix the transport to work with VMADDR_CID_ANY	2021-12-22 09:30:52 +01:00
wimax
wireless	cfg80211: call cfg80211_stop_ap when switch from P2P_GO type	2021-11-26 10:39:20 +01:00
x25
xdp	Revert "xsk: Do not sleep in poll() when need_wakeup set"	2021-12-22 09:30:59 +01:00
xfrm
compat.c
devres.c
Kconfig
Makefile
socket.c	ethtool: improve compat ioctl handling	2021-09-18 13:40:21 +02:00
sysctl_net.c