Nikita Zhandarovich 4bdd449977 net/rose: prevent integer overflows in rose_setsockopt() ...

[ Upstream commit d640627663 ]

In case of possible unpredictably large arguments passed to
rose_setsockopt() and multiplied by extra values on top of that,
integer overflows may occur.

Do the safest minimum and fix these issues by checking the
contents of 'opt' and returning -EINVAL if they are too large. Also,
switch to unsigned int and remove useless check for negative 'opt'
in ROSE_IDLE case.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Link: https://patch.msgid.link/20250115164220.19954-1-n.zhandarovich@fintech.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-03-13 12:46:50 +01:00

..

6lowpan

…

9p

9p/xen: fix release of IRQ

2024-12-14 19:48:15 +01:00

802

net: 802: LLC+SNAP OID:PID lookup on start of skb data

2025-02-01 18:22:18 +01:00

8021q

gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers

2024-09-12 11:06:47 +02:00

appletalk

…

atm

…

ax25

…

batman-adv

batman-adv: Do not let TT changes list grows indefinitely

2024-12-19 18:06:10 +01:00

bluetooth

Bluetooth: RFCOMM: Fix not validating setsockopt user input

2025-02-01 18:22:33 +01:00

bpf

…

bpfilter

…

bridge

net: bridge: xmit: make sure we have at least eth header len bytes

2024-11-17 14:59:37 +01:00

caif

…

can

net: af_can: do not leave a dangling sk pointer in can_create()

2024-12-14 19:48:27 +01:00

ceph

…

core

net: let net.core.dev_weight always be non-zero

2025-03-13 12:46:49 +01:00

dcb

…

dccp

net: fix data-races around sk->sk_forward_alloc

2025-02-01 18:22:31 +01:00

decnet

…

dns_resolver

…

dsa

…

ethernet

gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers

2024-09-12 11:06:47 +02:00

ethtool

ethtool: Fix wrong mod state in case of verbose and no_mask bitset

2024-12-14 19:48:20 +01:00

hsr

net: hsr: avoid potential out-of-bound access in fill_frame_info()

2024-12-14 19:48:19 +01:00

ieee802154

net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()

2024-12-14 19:48:27 +01:00

ife

…

ipv4

ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()

2025-02-01 18:22:33 +01:00

ipv6

net: fix data-races around sk->sk_forward_alloc

2025-02-01 18:22:31 +01:00

iucv

s390/iucv: fix receive buffer virtual vs physical address confusion

2024-09-04 13:17:38 +02:00

kcm

kcm: Serialise kcm_sendmsg() for the same socket.

2024-09-04 13:17:40 +02:00

key

…

l2tp

genetlink: hold RCU in genlmsg_mcast()

2024-11-08 16:21:57 +01:00

l3mdev

net: Add l3mdev index to flow struct and avoid oif reset for port devices

2024-10-17 15:08:35 +02:00

lapb

…

llc

net: llc: reset skb->transport_header

2025-01-09 13:25:03 +01:00

mac80211

wifi: mac80211: wake the queues in case of failure in resume

2025-01-09 13:25:04 +01:00

mac802154

mac802154: check local interfaces before deleting sdata list

2025-02-01 18:22:28 +01:00

mpls

…

mptcp

mptcp: handle consistently DSS corruption

2024-10-22 15:39:29 +02:00

ncsi

…

netfilter

netfilter: conntrack: clamp maximum hashtable size to INT_MAX

2025-02-01 18:22:19 +01:00

netlabel

…

netlink

netlink: terminate outstanding dump on socket close

2024-12-14 19:47:37 +01:00

netrom

netrom: check buffer length before accessing it

2025-01-09 13:25:02 +01:00

nfc

…

nsh

…

openvswitch

…

packet

af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK

2025-01-09 13:25:03 +01:00

phonet

…

psample

…

qrtr

net: qrtr: Update packets cloning when broadcasting

2024-10-17 15:07:58 +02:00

rds

net:rds: Fix possible deadlock in rds_message_put

2024-09-04 13:17:45 +02:00

rfkill

net: rfkill: gpio: Add check for clk_enable()

2024-12-14 19:47:55 +01:00

rose

net/rose: prevent integer overflows in rose_setsockopt()

2025-03-13 12:46:50 +01:00

rxrpc

…

sched

net: sched: Disallow replacing of child qdisc from one parent to another

2025-03-13 12:46:50 +01:00

sctp

sctp: sysctl: rto_min/max: avoid using current->nsproxy

2025-02-01 18:22:26 +01:00

smc

net/smc: fix data error when recvmsg with MSG_PEEK flag

2025-03-13 12:46:48 +01:00

strparser

…

sunrpc

sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport

2024-12-14 19:48:16 +01:00

switchdev

…

tipc

tipc: fix NULL deref in cleanup_bearer()

2024-12-19 18:06:10 +01:00

tls

tls: Fix tls_sw_sendmsg error handling

2025-02-01 18:22:19 +01:00

unix

af_unix: Remove put_pid()/put_cred() in copy_peercred().

2024-09-12 11:06:45 +02:00

vmw_vsock

vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]

2025-02-01 18:22:31 +01:00

wimax

…

wireless

wifi: cfg80211: adjust allocation of colocated AP data

2025-03-13 12:46:49 +01:00

x25

…

xdp

…

xfrm

xfrm: store and rely on direction to construct offload flags

2024-12-14 19:47:51 +01:00

compat.c

…

devres.c

…

Kconfig

…

Makefile

…

socket.c

…

sysctl_net.c

…