github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-04 18:29:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
87cd6b717e
linux/net
History
Zijie Huang d8b6529e80 net: arp: terminate device name before lookup 
The ARP ioctl copies a user-provided struct arpreq into a stack object. Its
arp_dev field may contain IFNAMSIZ bytes without a NUL terminator.

Such input is passed to dev_get_by_name_rcu() or __dev_get_by_name(), where
strcmp() can read past the end of the stack object when a matching
alternative interface name exists.

Terminate the field before the lookup to prevent the out-of-bounds read.

Fixes: 36fbf1e52b ("net: rtnetlink: add linkprop commands to add and delete alternative ifnames")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zijie Huang <milkory@outlook.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/fabf02a70787d17299e4b3153eadffaf20d154b3.1789910973.git.milkory@outlook.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-23 19:00:15 -07:00
..
6lowpan net: 6lowpan: fix mismatched comments 2026-09-02 09:03:06 +02:00
9p 9p: Add missing read barrier in virtio zero-copy path 2026-06-21 05:22:57 +00:00
802 appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
8021q vlan: fix skb_under_panic and races when toggling HW VLAN offload 2026-08-20 13:05:43 -07:00
atm pppoatm: ensure a writable skb header and linear data 2026-09-15 17:07:01 -07:00
batman-adv treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
bluetooth Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() 2026-09-21 09:37:20 -04:00
bpf bpf: Fix partial copy of non-linear test_run output 2026-06-21 17:55:06 -07:00
bridge net: bridge: mdb: restart port group walk after deletion 2026-09-23 16:51:03 -07:00
can can: isotp: check register_netdevice_notifier() error in module init 2026-07-29 11:26:41 +02:00
ceph libceph: remove pinning assertion in ceph_msg_data_iter_next() 2026-09-02 12:23:05 +02:00
core net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() 2026-09-23 17:41:22 -07:00
dcb
devlink treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
dns_resolver keys, dns: Drop unused NUL terminator from upayload->data 2026-08-10 16:20:42 -07:00
dsa net: dsa: tag_brcm: legacy FCS: request needed tailroom 2026-09-09 13:31:08 -07:00
ethernet
ethtool net: ethtool: keep rtnl_lock for the ioctl self test 2026-09-18 17:19:15 -07:00
handshake handshake: Require admin permission for DONE command 2026-06-12 15:45:44 -07:00
hsr net: hsr: enable promiscuous mode on interlink port with fwd offload 2026-09-10 08:45:00 -07:00
ieee802154 ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink 2026-09-02 09:54:27 +02:00
ife net/sched: act_ife: Only operate on Ethernet frames 2026-08-24 11:59:59 -07:00
ipv4 net: arp: terminate device name before lookup 2026-09-23 19:00:15 -07:00
ipv6 ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST 2026-09-23 18:34:13 -07:00
iucv net/iucv: fix the recvmsg window update 2026-08-31 15:51:22 -07:00
kcm net: kcm: Hold RCU read lock while running BPF parser 2026-08-17 13:43:58 -07:00
key ipsec-2026-06-22 2026-06-23 16:22:24 -07:00
l2tp net: l2tp: do not propagate multicast notification errors 2026-08-24 11:43:28 -07:00
l3mdev
lapb
llc llc: fix SAP refcount leak when creating incoming sockets 2026-07-17 13:17:46 +02:00
mac80211 Many fixes: 2026-09-16 15:54:56 -07:00
mac802154 mac802154: fix use-after-free of sdata via queued RX frames 2026-09-03 11:00:54 +02:00
mctp treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
mpls Summary 2026-08-20 08:46:41 -07:00
mptcp mptcp: fix bad accounting in __mptcp_subflow_push_pending() 2026-09-17 08:14:33 -07:00
ncsi net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length 2026-08-05 17:24:57 -07:00
netfilter netfilter: nf_tables: skip expired catchall elements on insert and delete 2026-09-18 11:24:05 +02:00
netlabel
netlink genetlink: report the real command id for dump-only ops in policy dumps 2026-09-22 15:21:32 +02:00
nfc nfc: nci: free destination parameters when closing a connection 2026-08-11 18:10:04 +02:00
nsh
openvswitch openvswitch: avoid reallocating confirmed conntrack labels 2026-09-15 18:00:46 -07:00
packet packet: use ubuf_info completion for TX_RING packets 2026-09-22 18:32:57 -07:00
phonet phonet: pep: convert getsockopt to sockopt_t 2026-08-03 16:55:23 -07:00
psample net: psample: fix info leak in PSAMPLE_ATTR_DATA 2026-06-17 16:35:50 -07:00
psp net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() 2026-09-16 19:18:24 -07:00
qrtr net: qrtr: Send HELLO message on endpoint register 2026-09-02 12:14:32 +01:00
rds rds: ib: use rds_conn_drop() on protocol version mismatch 2026-09-14 18:47:52 -07:00
rfkill Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
rxrpc treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
sched net/sched: act_gate: budget the per-entry list in get_fill_size 2026-09-23 16:42:50 -07:00
sctp sctp: hold asoc or transport before mod_timer() in timer handlers 2026-09-22 18:36:36 -07:00
shaper
smc Including fixes from Bluetooth, IPSec and Netfilter. 2026-08-27 13:53:43 -07:00
strparser
sunrpc treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
switchdev
tipc tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow 2026-09-18 15:42:47 -07:00
tls tls: device: fix out-of-bounds write in tls_append_frag() 2026-08-25 10:04:02 +02:00
unix af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). 2026-09-15 16:45:05 -07:00
vmw_vsock vsock: ignore empty child namespace mode writes 2026-09-17 19:06:31 -07:00
wireless Many fixes: 2026-09-16 15:54:56 -07:00
x25 net/x25: fix use-after-free of the socket by its timers 2026-07-30 18:46:45 -07:00
xdp xsk: honor XDP_TX_METADATA in zero-copy path 2026-08-24 11:12:00 -07:00
xfrm ipsec-2026-09-16 2026-09-16 15:54:19 -07:00
compat.c net: af_unix: useful handling of LSM denials on SCM_RIGHTS 2026-08-17 18:14:52 -07:00
devres.c
Kconfig appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
Kconfig.debug
Makefile appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
socket.c Major changes: 2026-08-20 07:36:20 -07:00
sysctl_net.c net: enforce net sysctl registration 2026-08-13 13:12:21 +02:00