Christophe JAILLET
38c46471f9
SUNRPC: Fix a potential buffer overflow in 'svc_print_xprts()' ...
[ Upstream commit b25b60d7bfb02a74bc3c2d998e09aab159df8059 ]
'maxlen' is the total size of the destination buffer. There is only one
caller and this value is 256.
When we compute the size already used and what we would like to add in
the buffer, the trailling NULL character is not taken into account.
However, this trailling character will be added by the 'strcat' once we
have checked that we have enough place.
So, there is a off-by-one issue and 1 byte of the stack could be
erroneously overwridden.
Take into account the trailling NULL, when checking if there is enough
place in the destination buffer.
While at it, also replace a 'sprintf' by a safer 'snprintf', check for
output truncation and avoid a superfluous 'strlen'.
Fixes: dc9a16e49d
2020-10-01 13:14:40 +02:00
6lowpan: Off by one handling ->nexthdr
2020-01-27 14:50:41 +01:00
net/9p: validate fds in p9_fd_open
2020-08-11 15:32:32 +02:00
vlan: vlan_changelink() should propagate errors
2020-01-12 12:17:28 +01:00
appletalk: Set error code if register_snap_client failed
2019-12-13 08:52:59 +01:00
net: use skb_queue_empty_lockless() in poll() handlers
2019-11-10 11:27:48 +01:00
AX.25: Prevent integer overflows in connect and sendmsg
2020-07-31 18:37:48 +02:00
batman-adv: bla: use netif_rx_ni when not in interrupt context
2020-09-09 19:04:24 +02:00
Bluetooth: L2CAP: handle l2cap config request during open state
2020-10-01 13:14:37 +02:00
bpf/test_run: support cgroup local storage
2018-08-03 00:47:32 +02:00
signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig
2020-01-27 14:50:51 +01:00
net: bridge: enfore alignment for ethernet address
2020-06-30 23:17:03 -04:00
net: use skb_queue_empty_lockless() in poll() handlers
2019-11-10 11:27:48 +01:00
can: gw: Fix error path of cgw_module_init
2019-08-29 08:28:30 +02:00
libceph: don't omit recovery_deletes in target_copy()
2020-07-22 09:32:13 +02:00
neigh_stat_seq_next() should increase position index
2020-10-01 13:14:29 +02:00
net: DCB: Validate DCB_ATTR_DCB_BUFFER argument
2020-09-26 18:01:29 +02:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2020-04-29 16:31:16 +02:00
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:13:37 +01:00
KEYS: Don't write out to userspace while holding key semaphore
2020-04-23 10:30:24 +02:00
dsa: Allow forwarding of redirected IGMP traffic
2020-09-23 12:10:56 +02:00
net: add annotations on hh->hh_len lockless accesses
2020-01-09 10:19:09 +01:00
hsr: check protocol version in hsr_newlink()
2020-04-21 09:03:03 +02:00
nl802154: add missing attribute validation for dev_type
2020-03-18 07:14:15 +01:00
rt_cpu_seq_next should increase position index
2020-10-01 13:14:29 +02:00
ipv6_route_seq_next should increase position index
2020-10-01 13:14:29 +02:00
net/af_iucv: always register net_device notifier
2020-01-27 14:50:56 +01:00
kcm: switch order of device registration to fix a crash
2019-04-17 08:38:40 +02:00
af_key: pfkey_dump needs parameter validation
2020-09-26 18:01:28 +02:00
l2tp: remove skb_dst_set() from l2tp_xmit_skb()
2020-07-22 09:31:59 +02:00
lapb: fixed leak of control-blocks.
2019-06-22 08:15:13 +02:00
net: silence data-races on sk_backlog.tail
2020-10-01 13:14:26 +02:00
mac80211: fix misplaced while instead of if
2020-08-21 11:05:32 +02:00
net: mac802154: tx: expand tailroom if necessary
2018-08-06 11:21:37 +02:00
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
2020-04-29 16:31:17 +02:00
net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler
2018-08-22 21:39:08 -07:00
netfilter: conntrack: allow sctp hearbeat after connection re-use
2020-09-17 13:45:24 +02:00
netlabel: fix problems with mapping removal
2020-09-12 13:40:22 +02:00
genetlink: remove genl_bind
2020-07-22 09:31:58 +02:00
net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
2020-04-29 16:31:21 +02:00
net/nfc/rawsock.c: add CAP_NET_RAW check.
2020-08-19 08:15:03 +02:00
nsh: set mac len based on inner packet
2018-07-12 16:55:29 -07:00
openvswitch: Prevent kernel-infoleak in ovs_ct_put_key()
2020-08-11 15:32:35 +02:00
af_packet: TPACKET_V3: fix fill status rwlock imbalance
2020-08-19 08:15:03 +02:00
net: use skb_queue_empty_lockless() in poll() handlers
2019-11-10 11:27:48 +01:00
net: psample: fix skb_over_panic
2019-12-05 09:21:30 +01:00
net: qrtr: check skb_put_padto() return value
2020-09-26 18:01:30 +02:00
rds: Prevent kernel-infoleak in rds_notify_queue_get()
2020-08-05 10:06:01 +02:00
rfkill: Fix incorrect check to avoid NULL pointer dereference
2020-01-12 12:17:17 +01:00
net/rose: fix unbound loop in rose_loopback_timer()
2019-05-02 09:59:00 +02:00
rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
2020-08-11 15:32:35 +02:00
net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc
2020-09-26 18:01:30 +02:00
sctp: move trace_sctp_probe_path into sctp_outq_sack
2020-10-01 13:14:30 +02:00
net/smc: Prevent kernel-infoleak in __smc_diag_dump()
2020-09-03 11:24:17 +02:00
net: strparser: partially revert "strparser: Call skb_unclone conditionally"
2019-05-16 19:41:27 +02:00
SUNRPC: Fix a potential buffer overflow in 'svc_print_xprts()'
2020-10-01 13:14:40 +02:00
tipc: use skb_unshare() instead in tipc_buf_append()
2020-09-26 18:01:30 +02:00
net/tls: Fix kmap usage
2020-08-19 08:15:03 +02:00
skbuff: fix a data race in skb_queue_len()
2020-10-01 13:14:32 +02:00
vsock: fix timeout in vsock_accept()
2020-06-10 21:34:59 +02:00
wimax: remove blank lines at EOF
2018-07-24 14:10:42 -07:00
cfg80211: regulatory: reject invalid hints
2020-09-09 19:04:32 +02:00
net/x25: Fix null-ptr-deref in x25_disconnect
2020-08-05 10:06:02 +02:00
xdp: Fix xsk_generic_xmit errno
2020-06-25 15:33:05 +02:00
xfrm: Fix double ESP trailer insertion in IPsec crypto offload.
2020-06-30 23:17:10 -04:00
net/compat: Add missing sock updates for SCM_RIGHTS
2020-08-21 11:05:32 +02:00
net: remove blank lines at end of file
2018-07-24 14:10:43 -07:00
bpfilter: check compiler capability in Kconfig
2018-06-28 13:36:39 +09:00
net: Set fput_needed iff FDPUT_FPUT is set
2020-08-19 08:15:03 +02:00
38c46471f9