Pavel Skripkin ad9d24c942 net: qrtr: fix OOB Read in qrtr_endpoint_post ... Syzbot reported slab-out-of-bounds Read in qrtr_endpoint_post. The problem was in wrong _size_ type: if (len != ALIGN(size, 4) + hdrlen) goto err; If size from qrtr_hdr is 4294967293 (0xfffffffd), the result of ALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293 in header this check won't fail and skb_put_data(skb, data + hdrlen, size); will read out of bound from data, which is hdrlen allocated block. Fixes: 194ccc8829 ("net: qrtr: Support decoding incoming v2 packets") Reported-and-tested-by: syzbot+1917d778024161609247@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2021-06-14 13:01:26 -07:00
..
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile	net: qrtr: Add MHI transport layer	2020-05-07 13:21:12 -07:00
mhi.c	net: qrtr: Avoid potential use after free in MHI send	2021-04-21 11:01:03 -07:00
ns.c	net: qrtr: fix null-ptr-deref in qrtr_ns_remove	2021-01-05 16:50:09 -08:00
qrtr.c	net: qrtr: fix OOB Read in qrtr_endpoint_post	2021-06-14 13:01:26 -07:00
qrtr.h	net: qrtr: fix null-ptr-deref in qrtr_ns_remove	2021-01-05 16:50:09 -08:00
smd.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284	2019-06-05 17:36:37 +02:00
tun.c	net: qrtr: Fix memory leak in qrtr_tun_open	2021-02-23 15:38:22 -08:00