linux/include/net
Dan Carpenter 6491d69839 nfc: nci: Potential off by one in ->pipes[] array
This is similar to commit e285d5bfb7 ("NFC: Fix the number of pipes")
where we changed NFC_HCI_MAX_PIPES from 127 to 128.

As the comment next to the define explains, the pipe identifier is 7
bits long.  The highest possible pipe is 127, but the number of possible
pipes is 128.  As the code is now, then there is potential for an
out of bounds array access:

    net/nfc/nci/hci.c:297 nci_hci_cmd_received() warn: array off by one?
    'ndev->hci_dev->pipes[pipe]' '0-127 == 127'

Fixes: 11f54f2286 ("NFC: nci: Add HCI over NCI protocol support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-04-06 15:05:07 -07:00
..
9p 9p: Add refcount to p9_req_t 2018-09-08 01:39:47 +09:00
bluetooth Bluetooth: Add quirk for reading BD_ADDR from fwnode property 2019-02-26 10:08:26 +01:00
caif
iucv net/af_iucv: locate IUCV header via skb_network_header() 2018-09-26 09:56:07 -07:00
netfilter netfilter: nf_tables: bogus EBUSY when deleting set after flush 2019-03-11 13:19:24 +01:00
netns netns: provide pure entropy for net_hash_mix() 2019-03-28 17:00:45 -07:00
nfc nfc: nci: Potential off by one in ->pipes[] array 2019-04-06 15:05:07 -07:00
phonet phonet: fix building with clang 2019-02-21 16:23:56 -08:00
sctp sctp: get sctphdr by offset in sctp_compute_cksum 2019-03-18 18:16:12 -07:00
tc_act net/sched: don't dereference a->goto_chain to read the chain index 2019-03-21 13:26:42 -07:00
6lowpan.h
Space.h
act_api.h net/sched: let actions use RCU to access 'goto_chain' 2019-03-21 13:26:42 -07:00
addrconf.h ipv6_stub: add ipv6_route_input stub/proxy. 2019-02-13 18:27:55 -08:00
af_ieee802154.h ieee802154: add rx LQI from userspace 2018-07-13 12:18:18 -04:00
af_rxrpc.h Revert "rxrpc: Allow failed client calls to be retried" 2019-01-15 21:33:36 -08:00
af_unix.h net: split out functions related to registering inflight socket files 2019-02-28 08:24:23 -07:00
af_vsock.h vsock: split dwork to avoid reinitializations 2018-08-07 12:39:13 -07:00
ah.h
arp.h
atmclip.h
ax25.h ax25: fix possible use-after-free 2019-01-23 11:18:00 -08:00
ax88796.h
bond_3ad.h bonding: count master 3ad stats separately 2019-01-24 22:18:48 -08:00
bond_alb.h
bond_options.h
bonding.h bonding: avoid possible dead-lock 2018-09-26 20:22:19 -07:00
busy_poll.h net: remove sock_poll_busy_flag 2018-07-30 09:10:25 -07:00
calipso.h
cfg80211-wext.h
cfg80211.h cfg80211: allow sending vendor events unicast 2019-02-22 13:46:43 +01:00
cfg802154.h
checksum.h Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
cipso_ipv4.h
cls_cgroup.h
codel.h
codel_impl.h
codel_qdisc.h
compat.h
datalink.h
dcbevent.h
dcbnl.h net: dcb: Add priority-to-DSCP map getters 2018-07-27 13:17:50 -07:00
devlink.h devlink: Add support for direct reporter health state update 2019-03-04 11:00:43 -08:00
dn.h
dn_dev.h
dn_fib.h
dn_neigh.h
dn_nsp.h
dn_route.h
dsa.h net: dsa: add KSZ9893 switch tagging support 2019-03-03 13:48:49 -08:00
dsfield.h
dst.h geneve, vxlan: Don't set exceptions if skb->len < mtu 2018-10-17 21:51:13 -07:00
dst_cache.h
dst_metadata.h
dst_ops.h
erspan.h erspan: set bso bit based on mirrored packet's len 2018-05-20 18:31:42 -04:00
esp.h
ethoc.h
failover.h net: Introduce generic failover module 2018-05-28 22:59:54 -04:00
fib_notifier.h
fib_rules.h
firewire.h
flow.h route: Add multipath_hash in flowi_common to make user-define hash 2019-02-27 12:50:17 -08:00
flow_dissector.h net/flow_dissector: correct comments on enum flow_dissector_key_id 2018-11-30 13:21:52 -08:00
flow_offload.h flow_offload: fix block stats 2019-02-13 21:07:47 -08:00
fou.h
fq.h
fq_impl.h
garp.h
gen_stats.h net: align gnet_stats_basic_cpu struct 2018-11-17 21:37:29 -08:00
genetlink.h genetlink: constify genl_err_attr() argument 2018-08-29 19:42:52 -07:00
geneve.h net: add netif_is_geneve() 2018-11-07 23:00:23 -08:00
gre.h net: Add netif_is_gretap()/netif_is_ip6gretap() 2018-12-10 15:53:04 -08:00
gro_cells.h
gtp.h
gue.h
hwbm.h
icmp.h net: Add __icmp_send helper. 2019-02-25 14:32:35 -08:00
ieee80211_radiotap.h wireless-drivers-next patches for 5.1 2019-02-22 12:56:24 -08:00
ieee802154_netdev.h
if_inet6.h net/ipv6: Add anycast addresses to a global hashtable 2018-11-02 23:54:56 -07:00
ife.h
ila.h
inet6_connection_sock.h
inet6_hashtables.h net: allow binding socket in a VRF when there's an unbound socket 2018-11-07 16:12:38 -08:00
inet_common.h net: use indirect call wrappers at GRO transport layer 2018-12-15 13:23:02 -08:00
inet_connection_sock.h tcp: change pingpong threshold to 3 2019-01-27 13:29:43 -08:00
inet_ecn.h inet: Refactor INET_ECN_decapsulate() 2018-10-17 17:45:07 -07:00
inet_frag.h net: remove unused struct inet_frag_queue.fragments field 2019-02-26 08:27:05 -08:00
inet_hashtables.h net: dccp: fix kernel crash on module load 2018-12-24 15:27:56 -08:00
inet_sock.h net: ensure unbound stream socket to be chosen when not in a VRF 2018-11-07 16:12:38 -08:00
inet_timewait_sock.h net-tcp: remove useless tw_timeout field 2018-06-05 10:45:24 -04:00
inetpeer.h net: ipv4: use a dedicated counter for icmp_v4 redirect packets 2019-02-08 21:50:15 -08:00
ip.h vrf: check accept_source_route on the original netdevice 2019-04-01 10:44:58 -07:00
ip6_checksum.h
ip6_fib.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-10-19 11:03:06 -07:00
ip6_route.h net: Add struct for fib dump filter 2018-10-16 00:13:12 -07:00
ip6_tunnel.h udp: Support for error handlers of tunnels with arbitrary destination port 2018-11-08 17:13:08 -08:00
ip_fib.h net: ipv4: Fix memory leak in network namespace dismantle 2019-01-15 13:33:44 -08:00
ip_tunnels.h route: Add multipath_hash in flowi_common to make user-define hash 2019-02-27 12:50:17 -08:00
ip_vs.h ipvs: avoid indirect calls when calculating checksums 2019-01-28 11:15:58 +01:00
ipcomp.h
ipconfig.h
ipv6.h ipv6: factor out protocol delivery helper 2018-11-07 16:23:05 -08:00
ipv6_frag.h net: IP6 defrag: use rbtrees for IPv6 defrag 2019-01-25 21:37:11 -08:00
ipx.h
iw_handler.h
kcm.h
l3mdev.h ipvlan, l3mdev: fix broken l3s mode wrt local routes 2019-01-30 22:13:34 -08:00
lag.h net: Add lag.h, net_lag_port_dev_txable() 2018-07-11 23:10:19 -07:00
lapb.h
lib80211.h
llc.h llc: avoid blocking in llc_sap_close() 2018-09-13 09:04:58 -07:00
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
lwtunnel.h bpf: implement BPF_LWT_ENCAP_IP mode in bpf_lwt_push_encap 2019-02-13 18:27:55 -08:00
mac80211.h mac80211: notify driver on subsequent CSA beacons 2019-02-22 13:45:51 +01:00
mac802154.h
mip6.h
mld.h
mpls.h
mpls_iptunnel.h
mrp.h
ncsi.h
ndisc.h
neighbour.h neighbour: register rtnl doit handler 2018-12-19 13:37:34 -08:00
net_failover.h net: Introduce net_failover driver 2018-05-28 22:59:54 -04:00
net_namespace.h netns: provide pure entropy for net_hash_mix() 2019-03-28 17:00:45 -07:00
net_ratelimit.h
netevent.h net: ipv4: Notify about changes to ip_forward_update_priority 2018-08-01 09:52:30 -07:00
netlabel.h
netlink.h netlink: reduce NLA_POLICY_NESTED{,_ARRAY} arguments 2019-02-01 11:06:55 +01:00
netprio_cgroup.h
netrom.h proc: introduce proc_create_seq{,_data} 2018-05-16 07:23:35 +02:00
nexthop.h
nl802154.h
nsh.h
p8022.h
page_pool.h xdp: introduce xdp_return_frame_rx_napi 2018-05-24 18:36:15 -07:00
ping.h ipv{4,6}/ping: simplify proc file creation 2018-05-16 07:23:35 +02:00
pkt_cls.h net: sched: set dedicated tcf_walker flag when tp is empty 2019-02-25 10:18:17 -08:00
pkt_sched.h net: sched: extend Qdisc with rcu 2018-09-25 20:17:35 -07:00
pptp.h
protocol.h net: Convert protocol error handlers from void to int 2018-11-08 17:13:08 -08:00
psample.h
psnap.h
raw.h net: fix raw socket lookup device bind matching with VRFs 2018-11-07 16:12:39 -08:00
rawv6.h
red.h
regulatory.h cfg80211: make wmm_rule part of the reg_rule structure 2018-08-28 11:11:47 +02:00
request_sock.h net: keep refcount warning in reqsk_free() 2019-03-09 19:51:44 -08:00
rose.h proc: introduce proc_create_seq{,_data} 2018-05-16 07:23:35 +02:00
route.h net-ipv4: remove 2 always zero parameters from ipv4_redirect() 2018-09-26 20:30:55 -07:00
rsi_91x.h
rtnetlink.h net: Add extack argument to rtnl_create_link 2018-11-06 15:00:45 -08:00
sch_generic.h net: sched: introduce and use qdisc tree flush/purge helpers 2019-04-01 14:50:13 -07:00
scm.h pids: Compute task_tgid using signal->leader_pid 2018-07-21 10:43:12 -05:00
secure_seq.h
seg6.h net: seg6.h: remove an unused #include 2018-12-20 16:56:04 -08:00
seg6_hmac.h rhashtable: split rhashtable.h 2018-06-22 13:43:27 +09:00
seg6_local.h bpf: add End.DT6 action to bpf_lwt_seg6_action helper 2018-07-31 09:22:48 +02:00
slhc_vj.h
smc.h net/smc: add smcd support to the pnet table 2019-02-21 10:34:37 -08:00
snmp.h
sock.h packets: Always register packet sk in the same order 2019-03-18 17:58:39 -07:00
sock_reuseport.h bpf: Enable BPF_PROG_TYPE_SK_REUSEPORT bpf prog in reuseport selection 2018-08-11 01:58:46 +02:00
stp.h
strparser.h strparser: Add __strp_unpause and use it in ktls. 2018-06-06 14:07:53 -04:00
switchdev.h switchdev: Remove unused transaction item queue 2019-03-01 21:35:19 -08:00
tcp.h tcp: convert tcp_md5_needed to static_branch API 2019-02-26 13:16:03 -08:00
tcp_states.h
timewait_sock.h
tipc.h
tls.h tls: Fix write space handling 2019-03-03 22:10:16 -08:00
transp_v6.h ipv6: fold sockcm_cookie into ipcm6_cookie 2018-07-07 10:58:49 +09:00
tso.h
tun_proto.h
udp.h net: Convert protocol error handlers from void to int 2018-11-08 17:13:08 -08:00
udp_tunnel.h udp_tunnel: add config option to bind to a device 2018-12-03 14:15:26 -08:00
udplite.h
vsock_addr.h
vxlan.h vxlan: add extack support for create and changelink 2019-02-26 08:54:37 -08:00
wext.h
wimax.h
x25.h
x25device.h
xdp.h xdp: export xdp_rxq_info_unreg_mem_model 2018-08-29 12:25:53 -07:00
xdp_sock.h xsk: fix umem memory leak on cleanup 2019-03-16 01:27:51 +01:00
xfrm.h xfrm: destroy xfrm_state synchronously on net exit path 2019-02-05 06:29:20 +01:00