]> git.baikalelectronics.ru Git - kernel.git/commit
net: qrtr: Fix an out of bounds read qrtr_endpoint_post()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 30 Jun 2020 11:46:15 +0000 (14:46 +0300)
committerDavid S. Miller <davem@davemloft.net>
Wed, 1 Jul 2020 01:36:13 +0000 (18:36 -0700)
commitdfb78bcc64f999698d7eb0fb67b7edd9573bd5f4
tree455655ae7ad1e53174166f45a484c2b3812786e8
parentc284be44de783c4aa4b9e41fa386d8c48b89d2b8
net: qrtr: Fix an out of bounds read qrtr_endpoint_post()

This code assumes that the user passed in enough data for a
qrtr_hdr_v1 or qrtr_hdr_v2 struct, but it's not necessarily true.  If
the buffer is too small then it will read beyond the end.

Reported-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reported-by: syzbot+b8fe393f999a291a9ea6@syzkaller.appspotmail.com
Fixes: 27121d1ab57e ("net: qrtr: Support decoding incoming v2 packets")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/qrtr/qrtr.c