Luka Gejak f229426072 net: hsr: fix potential OOB access in supervision frame handling ...

Ensure the entire TLV header is linearized before access by adding
sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this,
a truncated frame could cause an out-of-bounds access.

Fixes: eafaa88b3e ("net: hsr: Add support for redbox supervision frames")
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260523130330.61880-1-luka.gejak@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

2026-05-25 14:18:15 -07:00

..

6lowpan

net: replace ND_PRINTK with dynamic debug

2025-07-10 15:27:32 -07:00

9p

9p/trans_xen: replace simple_strto* with kstrtouint

2026-04-16 02:57:01 +00:00

802

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

8021q

8021q: delete cleared egress QoS mappings

2026-04-23 12:13:57 +02:00

appletalk

net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

2026-05-18 16:33:34 -07:00

atm

net: atm: fix skb leak in sigd_send() default branch

2026-05-12 18:07:02 -07:00

batman-adv

batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface

2026-05-19 10:43:54 +02:00

bluetooth

Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()

2026-05-20 16:35:47 -04:00

bpf

bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb

2026-04-12 15:42:57 -07:00

bridge

netfilter: ebtables: fix OOB read in compat_mtw_from_user

2026-05-22 12:28:46 +02:00

can

Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2026-04-14 18:36:10 -07:00

ceph

libceph: Fix potential null-ptr-deref in decode_choose_args()

2026-05-12 21:00:59 +02:00

core

net: bridge: prevent too big nested attributes in br_fill_linkxstats()

2026-05-21 08:47:36 -07:00

dcb

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

devlink

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-04-09 13:20:59 -07:00

dns_resolver

net: Add SPDX ids to some source files

2026-03-09 18:32:45 -07:00

dsa

net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops

2026-04-16 19:10:48 -07:00

ethernet

bonding: prevent potential infinite loop in bond_header_parse()

2026-03-16 19:29:45 -07:00

ethtool

ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics

2026-05-12 18:45:13 -07:00

handshake

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

hsr

net: hsr: fix potential OOB access in supervision frame handling

2026-05-25 14:18:15 -07:00

ieee802154

net: remove addr_len argument of recvmsg() handlers

2026-03-02 18:17:17 -08:00

ife

…

ipv4

ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

2026-05-22 19:05:31 -07:00

ipv6

ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

2026-05-25 11:08:00 -07:00

iucv

net/iucv: fix locking in .getsockopt

2026-05-22 17:40:32 -07:00

kcm

kcm: fix zero-frag skb in frag_list on partial sendmsg error

2026-02-23 17:26:55 -08:00

key

Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:19:01 -07:00

l2tp

l2tp: use list_del_rcu in l2tp_session_unhash

2026-05-21 08:47:20 -07:00

l3mdev

net: fib_rules: Fix iif / oif matching on L3 master device

2025-04-15 17:54:56 -07:00

lapb

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

llc

llc: Return -EINPROGRESS from llc_ui_connect()

2026-04-23 11:40:39 -07:00

mac80211

wifi: mac80211: consume only present negotiated TTLM maps

2026-05-20 11:20:37 +02:00

mac802154

bonding: prevent potential infinite loop in bond_header_parse()

2026-03-16 19:29:45 -07:00

mctp

net: mctp: test: Use dev_direct_xmit for TX to our test device

2026-04-30 13:36:47 -07:00

mpls

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-04-02 11:03:13 -07:00

mptcp

mptcp: update window_clamp on subflows when SO_RCVBUF is set

2026-05-19 15:36:35 +02:00

ncsi

net: ncsi: fix skb leak in error paths

2026-03-06 17:34:48 -08:00

netfilter

netfilter: nf_tables: fix dst corruption in same register operation

2026-05-22 12:28:46 +02:00

netlabel

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

netlink

net: netlink: don't set nsid on local notifications

2026-05-22 17:11:09 -07:00

nfc

NFC: digital: Bounds check NFC-A cascade depth in SDD response handler

2026-04-12 11:40:45 -07:00

nsh

nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().

2024-04-26 12:20:01 +02:00

openvswitch

openvswitch: vport: fix race between linking and the device notifier

2026-05-18 16:38:45 -07:00

packet

net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()

2026-04-22 20:16:34 -07:00

phonet

phonet/pep: disable BH around forwarded sk_receive_skb()

2026-05-21 07:38:21 -07:00

psample

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

psp

psp: strip variable-length PSP header in psp_dev_rcv()

2026-05-04 19:25:14 -07:00

qrtr

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-04-14 12:04:00 -07:00

rds

rds_tcp: close NULL deref window in rds_tcp_set_callbacks

2026-05-14 17:06:59 -07:00

rfkill

net: rfkill: prevent unlimited numbers of rfkill events from being created

2026-04-07 12:35:04 +02:00

rxrpc

rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer

2026-05-20 16:36:45 -07:00

sched

net/sched: sch_cbs: Call qdisc_reset for child qdisc

2026-05-13 17:53:39 -07:00

sctp

sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

2026-05-08 18:21:09 -07:00

shaper

net: shaper: rework the VALID marking (again)

2026-05-20 16:34:20 -07:00

smc

net/smc: Do not re-initialize smc hashtables

2026-05-22 17:38:02 -07:00

strparser

net: strparser: fix skb_head leak in strp_abort_strp()

2026-04-14 12:37:00 +02:00

sunrpc

Merge tag 'nfsd-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2026-05-15 13:11:41 -07:00

switchdev

bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign

2026-03-19 13:14:00 +01:00

tipc

Merge tag 'net-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-04-23 16:50:42 -07:00

tls

tls: Preserve sk_err across recvmsg() when data has been copied

2026-05-14 18:19:44 -07:00

unix

af_unix: Fix UAF read of tail->len in unix_stream_data_wait()

2026-05-19 18:53:56 -07:00

vmw_vsock

vsock/virtio: fix skb overhead overflow on 32-bit builds

2026-05-22 19:05:10 -07:00

wireless

wifi: cfg80211: wext: validate chandef in monitor mode

2026-05-20 11:44:19 +02:00

x25

Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:19:01 -07:00

xdp

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

2026-05-09 18:42:54 -07:00

xfrm

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

2026-04-29 11:27:34 +02:00

compat.c

socket: Unify getsockname and getpeername implementation

2025-11-26 13:45:23 -07:00

devres.c

…

Kconfig

net: remove ax25 and amateur radio (hamradio) subsystem

2026-04-23 10:24:02 -07:00

Kconfig.debug

rtnetlink: Add per-netns RTNL.

2024-10-08 15:16:59 +02:00

Makefile

net: remove ax25 and amateur radio (hamradio) subsystem

2026-04-23 10:24:02 -07:00

socket.c

Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2026-04-14 18:36:10 -07:00

sysctl_net.c

sysctl: Remove check for sentinel element in ctl_table arrays

2024-06-13 10:50:52 +02:00