Ross Lagerwall b14a3924c2 xen/netback: Fix buffer overrun triggered by unusual packet ... commit 534fc31d09 upstream. It is possible that a guest can send a packet that contains a head + 18 slots and yet has a len <= XEN_NETBACK_TX_COPY_LEN. This causes nr_slots to underflow in xenvif_get_requests() which then causes the subsequent loop's termination condition to be wrong, causing a buffer overrun of queue->tx_map_ops. Rework the code to account for the extra frag_overflow slots. This is CVE-2023-34319 / XSA-432. Fixes: ad7f402ae4 ("xen/netback: Ensure protocol headers don't fall in the non-linear area") Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com> Reviewed-by: Paul Durrant <paul@xen.org> Reviewed-by: Wei Liu <wei.liu@kernel.org> Signed-off-by: Juergen Gross <jgross@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-08-08 19:58:35 +02:00
..
accessibility	tty: fix possible null-ptr-defer in spk_ttyio_release	2023-01-24 07:22:46 +01:00
acpi	ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily	2023-08-03 10:22:46 +02:00
amba	…
android	binder: fix UAF of alloc->vma in race with munmap()	2023-06-05 09:21:25 +02:00
ata	ata: pata_ns87415: mark ns87560_tf_read static	2023-08-03 10:22:39 +02:00
atm	atm: idt77252: fix kmemleak when rmmod idt77252	2023-03-30 12:47:48 +02:00
auxdisplay	auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()	2023-03-11 13:57:22 +01:00
base	x86/srso: Add a Speculative RAS Overflow mitigation	2023-08-08 19:58:34 +02:00
bcma	…
block	rbd: retrieve and check lock owner twice before blocklisting	2023-08-03 10:22:46 +02:00
bluetooth	Bluetooth: hci_qca: fix debugfs registration	2023-06-14 11:13:06 +02:00
bus	bus: ixp4xx: fix IXP4XX_EXP_T1_MASK	2023-07-23 13:47:54 +02:00
cdrom	…
char	tpm_tis: Explicitly check for error code	2023-08-03 10:22:44 +02:00
clk	clk: qcom: ipq6018: fix networking resets	2023-07-23 13:47:22 +02:00
clocksource	clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe	2023-07-23 13:46:45 +02:00
comedi	comedi: adv_pci1760: Fix PWM instruction handling	2023-01-24 07:22:45 +01:00
connector	…
counter	counter: 104-quad-8: Fix race condition between FLAG and CNTR reads	2023-04-26 13:51:55 +02:00
cpufreq	cpufreq: intel_pstate: Drop ACPI _PSS states table patching	2023-08-03 10:22:47 +02:00
cpuidle	cpuidle: psci: Iterate backwards over list in psci_pd_remove()	2023-03-22 13:31:36 +01:00
crypto	crypto: qat - unmap buffers before free for RSA	2023-07-23 13:47:16 +02:00
cxl	…
dax	dax/kmem: Pass valid argument to memory_group_register_static	2023-07-23 13:47:17 +02:00
dca	…
devfreq	PM/devfreq: governor: Add a private governor_data for governor	2023-01-12 11:58:51 +01:00
dio	drivers: dio: fix possible memory leak in dio_init()	2022-12-31 13:14:27 +01:00
dma	dmaengine: pl330: rename _start to prevent build error	2023-06-09 10:32:15 +02:00
dma-buf	…
edac	EDAC/skx: Fix overflows on the DRAM row address mapping arrays	2023-05-11 23:00:20 +09:00
eisa	…
extcon	extcon: usbc-tusb320: Convert to i2c's .probe_new()	2023-07-23 13:47:31 +02:00
firewire	firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region	2023-02-09 11:26:32 +01:00
firmware	firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool()	2023-07-23 13:47:53 +02:00
fpga	fpga: bridge: fix kernel-doc parameter description	2023-05-11 23:00:31 +09:00
fsi	WRITE is "data source", not destination...	2023-02-09 11:26:34 +01:00
gnss	…
gpio	gpio: mvebu: fix irq domain leak	2023-08-03 10:22:26 +02:00
gpu	drm/amd: Fix an error handling mistake in psp_sw_init()	2023-08-03 10:22:39 +02:00
greybus	…
hid	HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651.	2023-07-05 18:25:05 +01:00
hsi	HSI: omap_ssi_core: Fix error handling in ssi_init()	2022-12-31 13:14:32 +01:00
hv	Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs	2023-06-28 10:29:42 +02:00
hwmon	hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled	2023-08-03 10:22:44 +02:00
hwspinlock	…
hwtracing	coresight: Fix loss of connection info when a module is unloaded	2023-07-23 13:47:23 +02:00
i2c	i2c: nomadik: Remove a useless call in the remove function	2023-08-03 10:22:27 +02:00
i3c	…
idle	…
iio	meson saradc: fix clock divider mask length	2023-07-23 13:47:54 +02:00
infiniband	RDMA/irdma: Report correct WC error	2023-08-03 10:22:39 +02:00
input	Input: adxl34x - do not hardcode interrupt trigger type	2023-07-23 13:46:59 +02:00
interconnect	interconnect: qcom: osm-l3: fix icc_onecell_data allocation	2023-03-30 12:47:41 +02:00
iommu	iommu/amd: Fix domain flush size when syncing iotlb	2023-06-09 10:32:31 +02:00
ipack	…
irqchip	irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation	2023-08-03 10:22:45 +02:00
isdn	mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()	2022-12-31 13:14:37 +01:00
leds	leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename	2023-07-23 13:47:36 +02:00
macintosh	macintosh: via-pmu-led: requires ATA to be set	2023-05-11 23:00:34 +09:00
mailbox	mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0	2023-07-23 13:47:28 +02:00
mcb	mcb-pci: Reallocate memory region to avoid memory overlapping	2023-05-24 17:36:47 +01:00
md	dm cache policy smq: ensure IO doesn't prevent cleaner policy progress	2023-08-03 10:22:46 +02:00
media	media: cec: i2c: ch7322: also select REGMAP	2023-07-23 13:47:27 +02:00
memory	memory: brcmstb_dpfe: fix testing array offset after use	2023-07-23 13:47:03 +02:00
memstick	memstick r592: make memstick_debug_get_tpc_name() static	2023-07-23 13:46:52 +02:00
message	scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition	2023-05-24 17:36:45 +01:00
mfd	mfd: pm8008: Fix module autoloading	2023-07-23 13:47:51 +02:00
misc	misc: pci_endpoint_test: Re-init completion for every test	2023-07-23 13:47:51 +02:00
mmc	mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used.	2023-07-23 13:47:32 +02:00
most	…
mtd	mtd: rawnand: meson: fix unaligned DMA buffers handling	2023-07-23 13:47:47 +02:00
mux	…
net	xen/netback: Fix buffer overrun triggered by unusual packet	2023-08-08 19:58:35 +02:00
nfc	nfcsim.c: Fix error checking for debugfs_create_dir	2023-06-28 10:29:51 +02:00
ntb	NTB: ntb_tool: Add check for devm_kcalloc	2023-07-23 13:47:42 +02:00
nubus	nubus: Partially revert proc_create_single_data() conversion	2023-07-05 18:25:05 +01:00
nvdimm	…
nvme	nvme-pci: fix DMA direction of unmapping integrity data	2023-07-23 13:47:46 +02:00
nvmem	nvmem: rmem: Use NVMEM_DEVID_AUTO	2023-07-23 13:47:25 +02:00
of	of: overlay: add entry to of_overlay_action_name[]	2023-06-21 15:59:19 +02:00
opp	opp: Fix use-after-free in lazy_opp_tables after probe deferral	2023-07-23 13:47:54 +02:00
parisc	parisc: Replace regular spinlock with spin_trylock on panic path	2023-05-24 17:36:48 +01:00
parport	…
pci	PCI: rockchip: Don't advertise MSI-X in PCIe capabilities	2023-08-03 10:22:28 +02:00
pcmcia	…
perf	perf/arm-cmn: Fix DTC reset	2023-07-23 13:46:46 +02:00
phy	phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()	2023-08-03 10:22:34 +02:00
pinctrl	pinctrl: amd: Use amd_pinconf_set() for all config options	2023-07-27 08:46:59 +02:00
platform	platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100	2023-08-03 10:22:35 +02:00
pnp	PNP: fix name memory leak in pnp_alloc_dev()	2022-12-31 13:14:02 +01:00
power	power: supply: Fix logic checking if system is running from battery	2023-06-21 15:59:13 +02:00
powercap	powercap: RAPL: Fix CONFIG_IOSF_MBI dependency	2023-07-23 13:46:46 +02:00
pps	…
ps3	…
ptp	ptp_qoriq: fix memory leak in probe()	2023-04-05 11:24:55 +02:00
pwm	pwm: meson: fix handling of period/duty if greater than UINT_MAX	2023-08-03 10:22:30 +02:00
rapidio	rapidio: devices: fix missing put_device in mport_cdev_open	2022-12-31 13:14:05 +01:00
ras	…
regulator	regulator: core: Streamline debugfs operations	2023-07-23 13:46:50 +02:00
remoteproc	remoteproc: stm32_rproc: Add mutex protection for workqueue	2023-05-24 17:36:44 +01:00
reset	reset: uniphier-glue: Fix possible null-ptr-deref	2023-02-01 08:27:04 +01:00
rpmsg	rpmsg: glink: Avoid infinite loop on intent for missing channel	2023-03-10 09:39:46 +01:00
rtc	rtc: st-lpc: Release some resources in st_rtc_probe() in case of error	2023-07-23 13:47:27 +02:00
s390	s390/dasd: fix hanging device after quiesce/resume	2023-08-03 10:22:45 +02:00
sbus	…
scsi	scsi: qla2xxx: Fix hang in task management	2023-08-03 10:22:32 +02:00
sh	genirq: Add and use an irq_data_update_affinity helper	2023-03-11 13:57:31 +01:00
siox	…
slimbus	…
soc	drivers: meson: secure-pwrc: always enable DMA domain	2023-07-23 13:47:09 +02:00
soundwire	soundwire: qcom: update status correctly with mask	2023-08-03 10:22:33 +02:00
spi	spi: bcm63xx: fix max prepend length	2023-07-27 08:46:58 +02:00
spmi	spmi: Add a check for remove callback when removing a SPMI driver	2023-05-11 23:00:34 +09:00
ssb	…
staging	staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()	2023-08-03 10:22:43 +02:00
target	scsi: target: iscsi: Prevent login threads from racing between each other	2023-06-28 10:29:50 +02:00
tc	…
tee	tee: amdtee: Add return_origin to 'struct tee_cmd_load_ta'	2023-06-14 11:13:06 +02:00
thermal	thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe()	2023-07-23 13:46:46 +02:00
thunderbolt	thunderbolt: Mask ring interrupt on Intel hardware as well	2023-06-21 15:59:15 +02:00
tty	tty: n_gsm: fix UAF in gsm_cleanup_mux	2023-08-03 10:22:43 +02:00
uio	uio: uio_dmem_genirq: Fix deadlock between irq config and handling	2022-12-31 13:14:27 +01:00
usb	Revert "xhci: add quirk for host controllers that don't update endpoint DCS"	2023-08-03 10:22:43 +02:00
vdpa	vduse: avoid empty string for dev name	2023-06-14 11:13:09 +02:00
vfio	vfio/type1: restore locked_vm	2023-03-10 09:40:13 +01:00
vhost	vhost_net: revert upend_idx only on retriable error	2023-06-28 10:29:53 +02:00
video	fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe	2023-07-27 08:47:02 +02:00
virt	…
virtio	virtio_ring: don't update event idx on get_buf	2023-05-11 23:00:34 +09:00
visorbus	…
vlynq	…
vme	vme: Fix error not catched in fake_init()	2022-12-31 13:14:30 +01:00
w1	w1: fix loop in w1_fini()	2023-07-23 13:47:20 +02:00
watchdog	watchdog: menz069_wdt: fix watchdog initialisation	2023-06-09 10:32:19 +02:00
xen	xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()	2023-05-30 13:55:32 +01:00
zorro	…
Kconfig	…
Makefile	…