Go to file
Stanislav Fort a67c6397fc batman-adv: fix OOB read/write in network-coding decode
commit d77b6ff0ce upstream.

batadv_nc_skb_decode_packet() trusts coded_len and checks only against
skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing
payload headroom, and the source skb length is not verified, allowing an
out-of-bounds read and a small out-of-bounds write.

Validate that coded_len fits within the payload area of both destination
and source sk_buffs before XORing.

Fixes: 2df5278b02 ("batman-adv: network coding - receive coded packets and decode them")
Cc: stable@vger.kernel.org
Reported-by: Stanislav Fort <disclosure@aisle.com>
Signed-off-by: Stanislav Fort <stanislav.fort@aisle.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-09 19:02:34 +02:00
arch x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() 2025-09-09 19:02:29 +02:00
block blk-zoned: Fix a lockdep complaint about recursive locking 2025-09-04 16:55:46 +02:00
certs
crypto crypto: acomp - Fix CFI failure due to type punning 2025-08-28 16:34:34 +02:00
Documentation dt-bindings: display/msm: qcom,mdp5: drop lut clock 2025-09-04 16:55:37 +02:00
drivers nouveau: Membar before between semaphore writes and the interrupt 2025-09-09 19:02:33 +02:00
fs proc: fix missing pde_set_flags() for net proc files 2025-09-09 19:02:31 +02:00
include mm: introduce and use {pgd,p4d}_populate_kernel() 2025-09-09 19:02:30 +02:00
init io_uring: fix breakage in EXPERT menu 2025-08-15 16:38:23 +02:00
io_uring io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths 2025-09-04 16:55:43 +02:00
ipc
kernel audit: fix out-of-bounds read in audit_compare_dname_path() 2025-09-09 19:02:34 +02:00
lib lib/sbitmap: convert shallow_depth from one word to the whole sbitmap 2025-08-20 18:41:31 +02:00
LICENSES
mm kunit: kasan_test: disable fortify string checker on kasan_strings() test 2025-09-09 19:02:30 +02:00
net batman-adv: fix OOB read/write in network-coding decode 2025-09-09 19:02:34 +02:00
rust rust: mm: mark VmaNew as transparent 2025-09-09 19:02:29 +02:00
samples samples/damon/mtier: support boot time enable setup 2025-08-20 18:41:35 +02:00
scripts kasan: fix GCC mem-intrinsic prefix with sw tags 2025-09-09 19:02:30 +02:00
security apparmor: Fix 8-byte alignment for initial dfa blob streams 2025-08-28 16:34:16 +02:00
sound ALSA: usb-audio: Add mute TLV for playback volumes on some devices 2025-09-09 19:02:28 +02:00
tools selftest: net: Fix weird setsockopt() in bind_bhash.c. 2025-09-09 19:02:28 +02:00
usr
virt
.clang-format
.clippy.toml
.cocciconfig
.editorconfig
.get_maintainer.ignore
.gitattributes
.gitignore gitignore: allow .pylintrc to be tracked 2025-08-15 16:39:03 +02:00
.mailmap 11 hotfixes. 9 are cc:stable and the remainder address post-6.15 issues 2025-07-24 19:13:30 -07:00
.pylintrc
.rustfmt.toml
COPYING
CREDITS mm: update MAINTAINERS entry for HMM 2025-07-19 19:26:16 -07:00
Kbuild
Kconfig
MAINTAINERS 11 hotfixes. 9 are cc:stable and the remainder address post-6.15 issues 2025-07-24 19:13:30 -07:00
Makefile Linux 6.16.5 2025-09-04 16:55:53 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.