Pengpeng Hou c06bde80ae net: usb: sr9700: include receive overhead in the length check ... The receive fixup subtracts the Ethernet CRC from the reported packet length, but compares that payload length against the whole remaining receive buffer. The following copy starts after the three-byte header, and the cursor advance consumes both that header and the four-byte CRC. Require the payload to fit after SR_RX_OVERHEAD before copying it or advancing to the next packet. The loop already ensures that the remaining buffer is larger than the overhead, so the subtraction is safe. The issue was found by our static-analysis tool. Fixes: c9b37458e9 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support") Reviewed-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Tested-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Signed-off-by: Pengpeng Hou <hppiscas@163.com> Link: https://patch.msgid.link/20260920034745.18468-1-hppiscas@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-09-21 17:22:54 -07:00
..
arcnet
bonding	bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()	2026-09-04 15:18:41 -07:00
can	can: m_can: pci: Remove driver_data	2026-08-17 19:20:38 +02:00
dsa	net: dsa: mxl862xx: disable the stats poll on teardown	2026-09-14 19:05:46 -07:00
ethernet	octeontx2-af: Fix memory scaling limitation in SR-IOV mode	2026-09-21 16:17:10 -07:00
fddi	net: fddi: skfp: fix NULL deref when setting the MAC address while down	2026-09-15 10:31:54 +02:00
fjes	fjes: cancel force_close_task in fjes_remove()	2026-08-06 09:19:58 -07:00
hyperv	hv_netvsc: Remove GPADL teardown special case for old Hyper-V hosts	2026-08-24 00:35:42 +00:00
ieee802154	ieee802154: hwsim: serialize pib updates to fix double-free	2026-09-02 10:26:47 +02:00
ipa	net: ipa: balance runtime PM reference on remove error	2026-08-20 12:26:24 -07:00
ipvlan	ipvlan: unregister upper devices outside pnodes_lock	2026-08-30 14:30:59 -07:00
mctp	net: mctp: i3c: serialize probe with bus removal	2026-09-05 09:39:00 +01:00
mdio
netdevsim	netdevsim: update queue NAPI association on queue reset	2026-08-20 12:35:57 -07:00
ovpn	ovpn: defer key slot crypto freeing to workqueue	2026-08-09 22:47:57 +02:00
pcs	net: pcs: rzn1-miic: Fix config array initialization	2026-09-17 17:07:43 -07:00
phy	net: phy: micrel: Advance register data pointer in write loop	2026-09-18 17:07:41 -07:00
plip
ppp	ppp_synctty: ensure a writeable skb header	2026-09-09 18:41:57 -07:00
pse-pd	net: pse-pd: realtek-pse-mcu: add UART transport	2026-08-18 15:04:33 +02:00
slip	slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()	2026-08-27 12:38:27 -07:00
team	net: team: check register_netdevice_notifier() error in team_module_init()	2026-08-04 18:50:02 -07:00
thunderbolt	Including fixes from Bluetooth, IPSec and Netfilter.	2026-08-27 13:53:43 -07:00
usb	net: usb: sr9700: include receive overhead in the length check	2026-09-21 17:22:54 -07:00
vmxnet3
vxlan	vxlan: initialize _md in vxlan_xmit_one()	2026-09-09 18:33:02 -07:00
wan	net: lapbether: check register_netdevice_notifier() error in lapbeth_init_driver()	2026-08-04 18:49:03 -07:00
wireguard
wireless	Including fixes from Netfilter, Bluetooth, IPSec and WiFi.	2026-09-17 10:40:48 -07:00
wwan	net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()	2026-09-16 18:58:45 -07:00
xen-netback
amt.c	amt: Don't support cross-netns setup.	2026-08-10 16:03:03 -07:00
bareudp.c
dummy.c
eql.c
geneve.c	net: geneve: remove unused geneve_dev_create_fb	2026-08-06 15:09:23 +02:00
gtp.c	net: iptunnel: fix stale transport header during tunnel decapsulation	2026-08-28 15:53:46 -07:00
ifb.c
Kconfig
LICENSE.SRC
loopback.c
macsec.c
macvlan.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-08-13 11:00:14 -07:00
macvtap.c
Makefile
mdio.c
mhi_net.c
mii.c
net_failover.c	net: net_failover: Fix the deadlock in net_failover_slave_name_change()	2026-09-10 15:19:06 +02:00
netconsole.c	netconsole: publish the userdata payload with RCU	2026-08-13 15:04:40 +02:00
netkit.c
nlmon.c
ntb_netdev.c	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
pfcp.c	pfcp: Support per-netns netdev unregistration.	2026-08-05 17:44:06 -07:00
rionet.c
sungem_phy.c
tap.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-08-13 11:00:14 -07:00
tun_vnet.h
tun.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-08-18 10:42:41 -07:00
veth.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-08-13 11:00:14 -07:00
virtio_net.c	virtio_net: Fix resize of the RX ring	2026-08-17 14:20:34 -07:00
vrf.c	net: vrf: check register_netdevice_notifier() error in vrf_init_module()	2026-08-04 18:53:35 -07:00
vsockmon.c
xen-netfront.c