Stanislav Fort bb37252c9a batman-adv: fix OOB read/write in network-coding decode ... commit d77b6ff0ce upstream. batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing. Fixes: 2df5278b02 ("batman-adv: network coding - receive coded packets and decode them") Cc: stable@vger.kernel.org Reported-by: Stanislav Fort <disclosure@aisle.com> Signed-off-by: Stanislav Fort <stanislav.fort@aisle.com> Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-09-09 18:56:27 +02:00
..
6lowpan
9p
802
8021q	net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime	2025-07-24 08:53:19 +02:00
appletalk	net: appletalk: Fix use-after-free in AARP proxy probe	2025-08-01 09:47:29 +01:00
atm	net: atm: fix memory leak in atm_register_sysfs when device_register fail	2025-09-09 18:56:25 +02:00
ax25	ax25: properly unshare skbs in ax25_kiss_rcv()	2025-09-09 18:56:25 +02:00
batman-adv	batman-adv: fix OOB read/write in network-coding decode	2025-09-09 18:56:27 +02:00
bluetooth	Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()	2025-09-09 18:56:21 +02:00
bpf
bpfilter
bridge	netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm	2025-09-09 18:56:21 +02:00
caif	caif: reduce stack size, again	2025-08-15 12:08:45 +02:00
can
ceph
core	net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM	2025-08-28 16:28:48 +02:00
dcb
dccp
devlink
dns_resolver
dsa
ethernet
ethtool
handshake
hsr	net, hsr: reject HSR frame if skb can't hold tag	2025-08-28 16:28:39 +02:00
ieee802154
ife
ipv4	ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()	2025-09-09 18:56:24 +02:00
ipv6	icmp: fix icmp_ndo_send address translation for reply direction	2025-09-09 18:56:22 +02:00
iucv
kcm
key
l2tp
l3mdev
lapb
llc
mac80211	wifi: mac80211: check basic rates validity in sta_link_apply_parameters	2025-08-28 16:28:41 +02:00
mac802154
mctp	mctp: return -ENOPROTOOPT for unknown getsockopt options	2025-09-09 18:56:24 +02:00
mpls	mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().	2025-06-27 11:09:02 +01:00
mptcp	mptcp: disable add_addr retransmission when timeout is 0	2025-08-28 16:28:44 +02:00
ncsi	net: ncsi: Fix buffer overflow in fetching version id	2025-08-28 16:28:24 +02:00
netfilter	netfilter: conntrack: helper: Replace -EEXIST by -EBUSY	2025-09-09 18:56:21 +02:00
netlabel	calipso: unlock rcu before returning -EAFNOSUPPORT	2025-06-19 15:28:46 +02:00
netlink	netlink: add variable-length / auto integers	2025-09-09 18:56:22 +02:00
netrom
nfc	NFC: nci: uart: Set tty->disc_data only in success path	2025-06-27 11:08:48 +01:00
nsh
openvswitch
packet	net/packet: fix a race in packet_set_ring() and packet_notifier()	2025-08-15 12:09:05 +02:00
phonet	phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()	2025-07-24 08:53:12 +02:00
psample
qrtr
rds	net: better track kernel sockets lifetime	2025-08-28 16:28:39 +02:00
rfkill
rose	net: rose: fix a typo in rose_clear_routes()	2025-09-04 15:30:28 +02:00
rxrpc	rxrpc: Fix transmission of an abort in response to an abort	2025-07-24 08:53:20 +02:00
sched	net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate	2025-08-28 16:28:49 +02:00
sctp	sctp: initialize more fields in sctp_v6_from_sk()	2025-09-04 15:30:26 +02:00
smc	net/smc: Remove validation of reserved bits in CLC Decline message	2025-09-09 18:56:24 +02:00
strparser
sunrpc	net: better track kernel sockets lifetime	2025-08-28 16:28:39 +02:00
switchdev
tipc	tipc: Fix use-after-free in tipc_conn_close().	2025-07-17 18:35:09 +02:00
tls	tls: fix handling of zero-length records on the rx_list	2025-08-28 16:28:46 +02:00
unix	af_unix: Don't set -ECONNRESET for consumed OOB skb.	2025-07-06 11:00:12 +02:00
vmw_vsock	vsock/virtio: Validate length in packet header before skb_put()	2025-08-28 16:28:36 +02:00
wireless	wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()	2025-09-09 18:56:24 +02:00
x25
xdp
xfrm	xfrm: Duplicate SPI Handling	2025-08-28 16:28:22 +02:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile
socket.c
sysctl_net.c