diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-06-30 14:46:15 +0300 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2020-07-01 04:36:13 +0300 |
commit | 8ff41cc21714704ef0158a546c3c4d07fae2c952 (patch) | |
tree | 455655ae7ad1e53174166f45a484c2b3812786e8 /drivers | |
parent | 6a2febec338df7e7699a52d00b2e1207dcf65b28 (diff) | |
download | linux-8ff41cc21714704ef0158a546c3c4d07fae2c952.tar.xz |
net: qrtr: Fix an out of bounds read qrtr_endpoint_post()
This code assumes that the user passed in enough data for a
qrtr_hdr_v1 or qrtr_hdr_v2 struct, but it's not necessarily true. If
the buffer is too small then it will read beyond the end.
Reported-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reported-by: syzbot+b8fe393f999a291a9ea6@syzkaller.appspotmail.com
Fixes: 194ccc88297a ("net: qrtr: Support decoding incoming v2 packets")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
0 files changed, 0 insertions, 0 deletions