Roded Zats 4a4b975778 rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation ... [ Upstream commit 1aec77b2bb ] Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute needs to be at least of sizeof(struct ifla_vf_vlan_info) which is 14 bytes. The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes) which is less than sizeof(struct ifla_vf_vlan_info) so this validation is not enough and a too small attribute might be cast to a struct ifla_vf_vlan_info, this might result in an out of bands read access when accessing the saved (casted) entry in ivvl. Fixes: 79aab093a0 ("net: Update API for VF vlan protocol 802.1ad support") Signed-off-by: Roded Zats <rzats@paloaltonetworks.com> Reviewed-by: Donald Hunter <donald.hunter@gmail.com> Link: https://lore.kernel.org/r/20240502155751.75705-1-rzats@paloaltonetworks.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-05-17 12:14:52 +02:00
..
6lowpan	net: fill in MODULE_DESCRIPTION()s for 6LoWPAN	2024-02-09 14:12:01 -08:00
9p	9p: Fix read/write debug statements to report server reply	2024-04-10 16:38:09 +02:00
802	net: fill in MODULE_DESCRIPTION()s under net/802*	2023-10-28 11:29:28 +01:00
8021q	net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb	2024-05-17 12:14:34 +02:00
appletalk	net: remove SOCK_DEBUG leftovers	2023-12-26 20:31:01 +00:00
atm	net: fill in MODULE_DESCRIPTION()s for mpoa	2024-02-09 14:12:01 -08:00
ax25	ax25: Fix netdev refcount issue	2024-05-02 16:35:16 +02:00
batman-adv	batman-adv: Avoid infinite loop trying to resize local TT	2024-04-17 11:23:24 +02:00
bluetooth	Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout	2024-05-17 12:14:52 +02:00
bpf	bpf: Fix dtor CFI	2023-12-15 16:25:55 -08:00
bridge	net: bridge: fix multicast-to-unicast with fraglist GSO	2024-05-17 12:14:33 +02:00
caif	net: fill in MODULE_DESCRIPTION()s for CAIF	2024-01-05 08:06:35 -08:00
can	can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)	2024-02-14 13:53:03 +01:00
ceph	libceph: init the cursor when preparing sparse read in msgr2	2024-03-06 12:43:01 +01:00
core	rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation	2024-05-17 12:14:52 +02:00
dcb
dccp	net: remove SOCK_DEBUG leftovers	2023-12-26 20:31:01 +00:00
devlink	devlink: fix port new reply cmd type	2024-03-26 18:17:36 -04:00
dns_resolver	Networking changes for 6.8.	2024-01-11 10:07:29 -08:00
dsa	net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events	2024-01-11 16:33:52 -08:00
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-05-02 16:35:30 +02:00
ethtool	ethtool: netlink: Add missing ethnl_ops_begin/complete	2024-01-18 13:21:06 +01:00
handshake	net/handshake: Fix handshake_req_destroy_test1	2024-02-08 18:32:29 -08:00
hsr	net: hsr: hsr_slave: Fix the promiscuous mode in offload mode	2024-04-10 16:37:56 +02:00
ieee802154	mac802154: Avoid new associations while disassociating	2023-12-15 11:14:57 +01:00
ife	net: sched: ife: fix potential use-after-free	2023-12-15 10:50:18 +00:00
ipv4	tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().	2024-05-17 12:14:51 +02:00
ipv6	xfrm: Preserve vlan tags for transport mode software GRO	2024-05-17 12:14:51 +02:00
iucv	net/iucv: fix the allocation size of iucv_path_table array	2024-02-16 09:25:09 +00:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-26 18:16:57 -04:00
key	net: fill in MODULE_DESCRIPTION()s for af_key	2024-02-09 14:12:01 -08:00
l2tp	net l2tp: drop flow hash on forward	2024-05-17 12:14:29 +02:00
l3mdev
lapb
llc	llc: call sock_orphan() at release time	2024-01-30 13:49:09 +01:00
mac80211	wifi: mac80211: fix prep_connection error path	2024-05-17 12:14:38 +02:00
mac802154	mac802154: fix llsec key resources release in mac802154_llsec_key_del	2024-04-03 15:32:15 +02:00
mctp	net: mctp: copy skb ext data when fragmenting	2024-03-26 18:16:49 -04:00
mpls	net: mpls: error out if inner headers are not set	2024-04-13 13:10:12 +02:00
mptcp	mptcp: don't account accept() of non-MPC client as fallback to TCP	2024-04-10 16:38:09 +02:00
ncsi	net/ncsi: Add NC-SI 1.2 Get MC MAC Address command	2023-11-18 15:00:51 +00:00
netfilter	netfilter: nf_tables: honor table dormant flag from netdev release event path	2024-05-02 16:35:21 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2023-12-07 14:23:12 -05:00
netlink	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter	2024-02-22 18:56:09 -08:00
netrom	netrom: Fix data-races around sysctl_net_busy_read	2024-03-07 10:36:58 +01:00
nfc	nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies	2024-05-17 12:14:45 +02:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 12:14:29 +02:00
openvswitch	net: openvswitch: Fix Use-After-Free in ovs_ct_exit	2024-05-02 16:35:20 +02:00
packet	packet: annotate data-races around ignore_outgoing	2024-03-26 18:17:34 -04:00
phonet	phonet/pep: fix racy skb_queue_empty() use	2024-02-22 09:05:50 +01:00
psample	genetlink: Use internal flags for multicast groups	2023-12-29 08:43:59 +00:00
qrtr	net: qrtr: ns: Return 0 if server port is not present	2024-01-01 18:41:29 +00:00
rds	net/rds: fix possible cp null dereference	2024-04-10 16:38:02 +02:00
rfkill	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-12-21 22:17:23 +01:00
rose	net/rose: fix races in rose_kill_by_device()	2023-12-15 11:59:53 +00:00
rxrpc	rxrpc: Clients must accept conn from any address	2024-05-17 12:14:33 +02:00
sched	net/sched: Fix mirred deadlock on device recursion	2024-04-27 17:12:53 +02:00
sctp	net: sctp: fix skb leak in sctp_inq_free()	2024-02-15 07:34:52 -08:00
smc	net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()	2024-04-13 13:10:02 +02:00
strparser
sunrpc	SUNRPC: add a missing rpc_stat for TCP TLS	2024-05-17 12:14:50 +02:00
switchdev	net: bridge: switchdev: Skip MDB replays of deferred events on offload	2024-02-16 09:36:37 +00:00
tipc	tipc: fix a possible memleak in tipc_buf_append	2024-05-17 12:14:33 +02:00
tls	tls: fix lockless read of strp->msg_ready in ->poll	2024-05-02 16:35:22 +02:00
unix	af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().	2024-05-02 16:35:23 +02:00
vmw_vsock	vsock/virtio: fix packet delivery to tap device	2024-04-10 16:38:03 +02:00
wireless	wifi: cfg80211: fix rdev_dump_mpp() arguments order	2024-05-17 12:14:37 +02:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:16:57 -04:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-04-17 11:23:28 +02:00
xfrm	xfrm: Preserve vlan tags for transport mode software GRO	2024-05-17 12:14:51 +02:00
compat.c	file: stop exposing receive_fd_user()	2023-12-12 14:24:14 +01:00
devres.c
Kconfig	bpfilter: remove bpfilter	2024-01-04 10:23:10 -08:00
Kconfig.debug
Makefile	bpfilter: remove bpfilter	2024-01-04 10:23:10 -08:00
socket.c	vfs-6.8.iov_iter	2024-01-08 11:43:04 -08:00
sysctl_net.c