Stanislav Fort a67c6397fc batman-adv: fix OOB read/write in network-coding decode ... commit d77b6ff0ce upstream. batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing. Fixes: 2df5278b02 ("batman-adv: network coding - receive coded packets and decode them") Cc: stable@vger.kernel.org Reported-by: Stanislav Fort <disclosure@aisle.com> Signed-off-by: Stanislav Fort <stanislav.fort@aisle.com> Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-09-09 19:02:34 +02:00
..
bat_algo.c
bat_algo.h
bat_iv_ogm.c
bat_iv_ogm.h
bat_v_elp.c
bat_v_elp.h
bat_v_ogm.c
bat_v_ogm.h
bat_v.c
bat_v.h
bitarray.c
bitarray.h
bridge_loop_avoidance.c
bridge_loop_avoidance.h
distributed-arp-table.c
distributed-arp-table.h
fragmentation.c
fragmentation.h
gateway_client.c
gateway_client.h
gateway_common.c
gateway_common.h
hard-interface.c
hard-interface.h
hash.c
hash.h
Kconfig
log.c
log.h
main.c
main.h
Makefile
mesh-interface.c
mesh-interface.h
multicast_forw.c
multicast.c
multicast.h
netlink.c
netlink.h
network-coding.c	batman-adv: fix OOB read/write in network-coding decode	2025-09-09 19:02:34 +02:00
network-coding.h
originator.c
originator.h
routing.c
routing.h
send.c
send.h
tp_meter.c	treewide, timers: Rename from_timer() to timer_container_of()	2025-06-08 09:07:37 +02:00
tp_meter.h
trace.c
trace.h
translation-table.c
translation-table.h
tvlv.c
tvlv.h
types.h