mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-06-02 14:33:12 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
bdd39576bf50a50bdafe3da968fd271bc674a48f
linux/net
History
Eric Dumazet bdd39576bf net: bridge: prevent too big nested attributes in br_fill_linkxstats() 
After commit ff205bf8c554 ("netlink: add one debug check in nla_nest_end()")
syzbot found that br_fill_linkxstats() can send corrupted netlink packets.

Make sure the nested attribute size is bounded.

Fixes: a60c090361 ("bridge: netlink: export per-vlan stats")
Reported-by: syzbot+a35f9259d08f907c06e6@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a0b0da3.050a0220.175f0c.0000.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260520114207.1394241-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-21 08:47:36 -07:00
..
6lowpan
net: replace ND_PRINTK with dynamic debug
2025-07-10 15:27:32 -07:00
9p
9p/trans_xen: replace simple_strto* with kstrtouint
2026-04-16 02:57:01 +00:00
802
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
8021q
8021q: delete cleared egress QoS mappings
2026-04-23 12:13:57 +02:00
appletalk
net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
2026-05-18 16:33:34 -07:00
atm
net: atm: fix skb leak in sigd_send() default branch
2026-05-12 18:07:02 -07:00
batman-adv
batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
2026-05-19 10:43:54 +02:00
bluetooth
Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
2026-05-20 16:35:47 -04:00
bpf
bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
2026-04-12 15:42:57 -07:00
bridge
net: bridge: prevent too big nested attributes in br_fill_linkxstats()
2026-05-21 08:47:36 -07:00
can
Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2026-04-14 18:36:10 -07:00
ceph
libceph: Fix slab-out-of-bounds access in auth message processing
2026-04-22 01:40:23 +02:00
core
net: bridge: prevent too big nested attributes in br_fill_linkxstats()
2026-05-21 08:47:36 -07:00
dcb
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
devlink
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-04-09 13:20:59 -07:00
dns_resolver
net: Add SPDX ids to some source files
2026-03-09 18:32:45 -07:00
dsa
net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops
2026-04-16 19:10:48 -07:00
ethernet
bonding: prevent potential infinite loop in bond_header_parse()
2026-03-16 19:29:45 -07:00
ethtool
ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
2026-05-12 18:45:13 -07:00
handshake
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
hsr
net: hsr: defer node table free until after RCU readers
2026-05-15 18:25:26 -07:00
ieee802154
net: remove addr_len argument of recvmsg() handlers
2026-03-02 18:17:17 -08:00
ife
…
ipv4
net: skbuff: propagate shared-frag marker through frag-transfer helpers
2026-05-21 11:31:05 +02:00
ipv6
ipv6: ioam: refresh hdr pointer before ioam6_event()
2026-05-21 08:19:25 -07:00
iucv
net/iucv: Add missing kernel-doc return value descriptions
2026-03-31 20:14:56 -07:00
kcm
kcm: fix zero-frag skb in frag_list on partial sendmsg error
2026-02-23 17:26:55 -08:00
key
Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:19:01 -07:00
l2tp
l2tp: use list_del_rcu in l2tp_session_unhash
2026-05-21 08:47:20 -07:00
l3mdev
net: fib_rules: Fix iif / oif matching on L3 master device
2025-04-15 17:54:56 -07:00
lapb
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
llc
llc: Return -EINPROGRESS from llc_ui_connect()
2026-04-23 11:40:39 -07:00
mac80211
wifi: mac80211: remove station if connection prep fails
2026-05-06 11:02:57 +02:00
mac802154
bonding: prevent potential infinite loop in bond_header_parse()
2026-03-16 19:29:45 -07:00
mctp
net: mctp: test: Use dev_direct_xmit for TX to our test device
2026-04-30 13:36:47 -07:00
mpls
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-04-02 11:03:13 -07:00
mptcp
mptcp: update window_clamp on subflows when SO_RCVBUF is set
2026-05-19 15:36:35 +02:00
ncsi
net: ncsi: fix skb leak in error paths
2026-03-06 17:34:48 -08:00
netfilter
netfilter: nf_queue: hold bridge skb->dev while queued
2026-05-16 13:23:01 +02:00
netlabel
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
netlink
genetlink: free the skb on 'group >= family->n_mcgrps'
2026-05-08 15:43:29 -07:00
nfc
NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
2026-04-12 11:40:45 -07:00
nsh
…
openvswitch
openvswitch: vport: fix race between linking and the device notifier
2026-05-18 16:38:45 -07:00
packet
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
2026-04-22 20:16:34 -07:00
phonet
phonet/pep: disable BH around forwarded sk_receive_skb()
2026-05-21 07:38:21 -07:00
psample
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
psp
psp: strip variable-length PSP header in psp_dev_rcv()
2026-05-04 19:25:14 -07:00
qrtr
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-04-14 12:04:00 -07:00
rds
rds_tcp: close NULL deref window in rds_tcp_set_callbacks
2026-05-14 17:06:59 -07:00
rfkill
net: rfkill: prevent unlimited numbers of rfkill events from being created
2026-04-07 12:35:04 +02:00
rxrpc
rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
2026-05-20 16:36:45 -07:00
sched
net/sched: sch_cbs: Call qdisc_reset for child qdisc
2026-05-13 17:53:39 -07:00
sctp
sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
2026-05-08 18:21:09 -07:00
shaper
net: shaper: rework the VALID marking (again)
2026-05-20 16:34:20 -07:00
smc
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
2026-05-14 12:20:06 +02:00
strparser
net: strparser: fix skb_head leak in strp_abort_strp()
2026-04-14 12:37:00 +02:00
sunrpc
Merge tag 'nfs-for-7.1-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs
2026-04-24 14:20:03 -07:00
switchdev
bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign
2026-03-19 13:14:00 +01:00
tipc
Merge tag 'net-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-04-23 16:50:42 -07:00
tls
tls: Preserve sk_err across recvmsg() when data has been copied
2026-05-14 18:19:44 -07:00
unix
af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
2026-05-19 18:53:56 -07:00
vmw_vsock
vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
2026-05-21 13:14:01 +02:00
wireless
wifi: nl80211: re-check wiphy netns in nl80211_prepare_wdev_dump() continuation
2026-05-06 11:08:41 +02:00
x25
Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:19:01 -07:00
xdp
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
2026-05-09 18:42:54 -07:00
xfrm
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
2026-04-29 11:27:34 +02:00
compat.c
socket: Unify getsockname and getpeername implementation
2025-11-26 13:45:23 -07:00
devres.c
…
Kconfig
net: remove ax25 and amateur radio (hamradio) subsystem
2026-04-23 10:24:02 -07:00
Kconfig.debug
…
Makefile
net: remove ax25 and amateur radio (hamradio) subsystem
2026-04-23 10:24:02 -07:00
socket.c
Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2026-04-14 18:36:10 -07:00
sysctl_net.c
…