diff options
| author | Rafael J. Wysocki <rafael.j.wysocki@intel.com> | 2025-09-29 10:10:05 +0200 |
|---|---|---|
| committer | Rafael J. Wysocki <rafael.j.wysocki@intel.com> | 2025-09-29 10:10:05 +0200 |
| commit | 17eb8812917b10ce4146b5595f91d8e45bfe68cc (patch) | |
| tree | f905aa6c71212f4b460e23ceaec98346b999066a /net/batman-adv/network-coding.c | |
| parent | 57610d69f909ea2ea072775c6ad64ba9fad590bb (diff) | |
| parent | 23199d2aa6dcaf6dd2da772f93d2c94317d71459 (diff) | |
Merge tag 'linux-cpupower-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux
Merge cpupower utility updates for 6.18-rc1 from Shuah Khan:
"Fixes incorrect return vale in cpupower_write_sysfs() error path
and passing incorrect size to cpuidle_state_write_file() while
writing status to disable file in cpuidle_state_disable()."
* tag 'linux-cpupower-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: (1125 commits)
tools/cpupower: Fix incorrect size in cpuidle_state_disable()
tools/cpupower: fix error return value in cpupower_write_sysfs()
Linux 6.17-rc6
MAINTAINERS: Input: Drop melfas-mip4 section
USB: core: remove the move buf action
MAINTAINERS: Update the DMA Rust entry
erofs: fix long xattr name prefix placement
Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups"
hsr: hold rcu and dev lock for hsr_get_port_ndev
hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
hsr: use rtnl lock when iterating over ports
wifi: nl80211: completely disable per-link stats for now
net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups
net: ethtool: fix wrong type used in struct kernel_ethtool_ts_info
selftests/bpf: Skip timer cases when bpf_timer is not supported
bpf: Reject bpf_timer for PREEMPT_RT
libceph: fix invalid accesses to ceph_connection_v1_info
PM: hibernate: Restrict GFP mask in hibernation_snapshot()
MAINTAINERS: add Phil as netfilter reviewer
netfilter: nf_tables: restart set lookup on base_seq change
...
Diffstat (limited to 'net/batman-adv/network-coding.c')
| -rw-r--r-- | net/batman-adv/network-coding.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c index 9f56308779cc..af97d077369f 100644 --- a/net/batman-adv/network-coding.c +++ b/net/batman-adv/network-coding.c @@ -1687,7 +1687,12 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb, coding_len = ntohs(coded_packet_tmp.coded_len); - if (coding_len > skb->len) + /* ensure dst buffer is large enough (payload only) */ + if (coding_len + h_size > skb->len) + return NULL; + + /* ensure src buffer is large enough (payload only) */ + if (coding_len + h_size > nc_packet->skb->len) return NULL; /* Here the magic is reversed: |