|
KMSAN: kernel-infoleak in move_addr_to_user (7)
prio:high
hams
wpan
|
9 |
syz, C |
|
|
46 |
139d |
726d
|
29/29 |
65d |
4db86f8ab11b
ieee802154: fix kernel-infoleak in dgram_recvmsg()
|
|
KMSAN: uninit-value in sixpack_receive_buf (4)
hams
|
7 |
|
|
|
8 |
248d |
297d
|
29/29 |
120d |
bf9a38803b26
net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
|
|
general protection fault in rose_transmit_link (4)
hams
|
21 |
syz, C |
error |
|
2058 |
175d |
245d
|
29/29 |
120d |
e1f0a18c9564
net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
|
|
BUG: unable to handle kernel paging request in sk_skb_reason_drop
hams
|
22 |
syz, C |
|
|
39 |
156d |
245d
|
29/29 |
135d |
ba1096c31528
netrom: fix double-free in nr_route_frame()
|
|
memory leak in nr_sendmsg
hams
|
3 |
syz, C |
|
|
1 |
297d |
293d
|
29/29 |
240d |
613d12dd794e
netrom: Fix memory leak in nr_sendmsg()
|
|
possible deadlock in serial8250_handle_irq
hams
|
4 |
syz, C |
|
|
180 |
353d |
1154d
|
29/29 |
323d |
38b04ed7072e
6pack: drop redundant locking and refcounting
|
|
general protection fault in rose_rt_ioctl
hams
|
2 |
syz, C |
|
|
64 |
386d |
387d
|
29/29 |
344d |
1cc8a5b534e5
net: rose: fix a typo in rose_clear_routes()
|
|
KASAN: slab-use-after-free Read in rose_timer_expiry (3)
hams
|
19 |
|
|
|
6059 |
380d |
487d
|
29/29 |
344d |
da9c9c877597
net: rose: include node references in rose_neigh refcount
|
|
KASAN: slab-use-after-free Read in rose_get_neigh
hams
|
19 |
syz, C |
error |
|
1449 |
437d |
829d
|
29/29 |
379d |
34a500caf48c
rose: fix dangling neighbour pointers in rose_rt_device_down()
|
|
WARNING: refcount bug in ax25_release (3)
hams
|
13 |
syz, C |
done |
|
5256 |
540d |
844d
|
28/29 |
465d |
bca0902e6173
ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt
2f6efbabceb6
ax25: Remove broken autobind
|
|
BUG: soft lockup in rose_loopback_timer
hams
|
1 |
syz, C |
|
|
1 |
595d |
592d
|
28/29 |
465d |
a1300691aed9
net: rose: lock the socket in rose_bind()
|
|
KASAN: slab-use-after-free Read in rose_timer_expiry (2)
hams
|
19 |
|
|
|
158 |
492d |
616d
|
28/29 |
491d |
5de7665e0a07
net: rose: fix timer races against user threads
|
|
possible deadlock in ax25_setsockopt
hams
|
4 |
|
|
|
2 |
618d |
626d
|
28/29 |
497d |
95fc45d1dea8
ax25: rcu protect dev->ax25_ptr
|
|
kernel BUG in nr_header
hams
|
-1 |
|
|
|
2 |
666d |
653d
|
28/29 |
500d |
a6d75ecee2bf
net: lapb: increase LAPB_HEADER_LEN
|
|
memory leak in nr_create (3)
hams
|
3 |
syz, C |
|
|
9 |
1003d |
1192d
|
26/29 |
800d |
0b9130247f3b
netrom: Fix a memory leak in nr_heartbeat_expiry()
|
|
possible deadlock in nr_rt_ioctl
hams
|
4 |
syz, C |
inconclusive |
|
8 |
839d |
866d
|
25/29 |
833d |
e03e7f20ebf7
netrom: fix possible dead-lock in nr_rt_ioctl()
|
|
WARNING: refcount bug in ax25_release (2)
hams
|
13 |
syz, C |
|
|
240 |
848d |
914d
|
25/29 |
848d |
467324bcfe1a
ax25: Fix netdev refcount issue
|
|
WARNING in rose_device_event
hams
|
-1 |
|
|
|
1 |
1010d |
1010d
|
25/29 |
970d |
64b8bc7d5f14
net/rose: fix races in rose_kill_by_device()
|
|
general protection fault in prepare_to_wait (2)
hams
|
8 |
syz |
inconclusive |
|
4 |
1089d |
1127d
|
23/29 |
1072d |
c2f8fd794960
netrom: Deny concurrent connect().
|
|
KASAN: use-after-free Write in nr_release
hams
|
22 |
syz, C |
done |
error |
1784 |
1212d |
2485d
|
22/29 |
1198d |
611792920925
netrom: Fix use-after-free caused by accept on already connected socket
|
|
WARNING: refcount bug in nr_release (4)
hams
|
13 |
syz, C |
|
|
24 |
1312d |
1617d
|
22/29 |
1198d |
409db27e3a2e
netrom: Fix use-after-free of a listening socket.
|
|
KASAN: use-after-free Read in do_accept
hams
|
19 |
|
|
|
1 |
1344d |
1339d
|
22/29 |
1198d |
409db27e3a2e
netrom: Fix use-after-free of a listening socket.
|
|
memory leak in nr_create (2)
hams
|
3 |
syz, C |
|
|
11 |
1268d |
1328d
|
22/29 |
1198d |
611792920925
netrom: Fix use-after-free caused by accept on already connected socket
|
|
general protection fault in ax25_send_frame (2)
hams
|
10 |
|
|
|
13 |
1413d |
1400d
|
22/29 |
1302d |
e97c089d7a49
rose: Fix NULL pointer dereference in rose_send_frame()
|
|
general protection fault in rose_send_frame (2)
hams
|
2 |
|
|
|
7 |
1415d |
1440d
|
22/29 |
1302d |
e97c089d7a49
rose: Fix NULL pointer dereference in rose_send_frame()
|
|
KASAN: use-after-free Read in sixpack_close
hams
|
19 |
syz, C |
done |
|
879 |
1764d |
1769d
|
20/29 |
1655d |
81b1d548d00b
hamradio: remove needs_free_netdev to avoid UAF
|
|
memory leak in nr_create
hams
|
3 |
syz, C |
|
|
250 |
1885d |
2670d
|
20/29 |
1773d |
517a16b1a88b
netrom: Decrease sock refcount when sock timers expire
|
|
KASAN: slab-out-of-bounds Write in decode_data
hams
|
21 |
syz, C |
done |
error |
7 |
2324d |
2479d
|
20/29 |
1773d |
19d1532a1876
net: 6pack: fix slab-out-of-bounds in decode_data
|
|
KMSAN: uninit-value in ax25_connect
hams
|
7 |
syz, C |
|
|
15 |
2201d |
2333d
|
15/29 |
2192d |
2f2a7ffad5c6
AX.25: Fix out-of-bounds read in ax25_connect()
|
|
KMSAN: uninit-value in __dev_get_by_name
hams
|
7 |
syz, C |
|
|
2 |
2316d |
2316d
|
15/29 |
2254d |
687775cec056
ax25: fix setsockopt(SO_BINDTODEVICE)
|
|
WARNING: held lock freed! (2)
hams
|
-1 |
syz, C |
done |
|
1 |
2632d |
2628d
|
12/29 |
2579d |
4638faac0327
netrom: hold sock when setting skb->destructor
|
|
KASAN: use-after-free Read in release_sock
hams
|
19 |
syz, C |
done |
|
10 |
2602d |
2611d
|
12/29 |
2579d |
4638faac0327
netrom: hold sock when setting skb->destructor
|
|
KASAN: use-after-free Read in nr_release
hams
|
19 |
syz, C |
done |
|
25 |
2580d |
2659d
|
12/29 |
2579d |
4638faac0327
netrom: hold sock when setting skb->destructor
|
|
KASAN: use-after-free Read in nr_insert_socket
hams
|
19 |
syz, C |
done |
|
22 |
2603d |
2619d
|
12/29 |
2579d |
4638faac0327
netrom: hold sock when setting skb->destructor
|
|
KASAN: use-after-free Read in nr_rx_frame (2)
hams
|
19 |
syz, C |
done |
|
3 |
2606d |
2614d
|
12/29 |
2579d |
4638faac0327
netrom: hold sock when setting skb->destructor
|
|
memory leak in nr_rx_frame
hams
|
3 |
syz, C |
|
|
5 |
2607d |
2670d
|
12/29 |
2601d |
c8c8218ec5af
netrom: fix a memory leak in nr_rx_frame()
|
|
inconsistent lock state in ax25_destroy_timer
hams
|
4 |
|
|
|
2 |
2650d |
2651d
|
12/29 |
2626d |
d4d5d8e83c96
ax25: fix inconsistent lock state in ax25_destroy_timer
|
|
inconsistent lock state in ax25_rt_autobind
hams
|
4 |
|
|
|
2 |
2650d |
2651d
|
12/29 |
2626d |
d4d5d8e83c96
ax25: fix inconsistent lock state in ax25_destroy_timer
|
|
INFO: rcu detected stall in rose_loopback_timer
hams
|
1 |
|
|
|
5 |
2686d |
2705d
|
12/29 |
2671d |
0453c6824595
net/rose: fix unbound loop in rose_loopback_timer()
|
|
KASAN: stack-out-of-bounds Write in rose_write_internal
hams
|
21 |
|
|
|
1 |
2745d |
2745d
|
12/29 |
2718d |
e5dcc0c3223c
net: rose: fix a possible stack overflow
|
|
general protection fault in ax25cmp
hams
|
2 |
syz, C |
|
|
2294 |
2788d |
2820d
|
11/29 |
2753d |
b0cf029234f9
net/rose: fix NULL ax25_cb kernel panic
|
|
KASAN: use-after-free Read in refcount_inc_not_zero_checked
hams
|
19 |
syz |
|
|
24 |
2756d |
2816d
|
11/29 |
2753d |
63346650c1a9
netrom: switch to sock timer API
|
|
KASAN: use-after-free Read in kmemdup
hams
|
19 |
|
|
|
1 |
2799d |
2799d
|
11/29 |
2753d |
63530aba7826
ax25: fix possible use-after-free
|
|
WARNING: refcount bug in nr_release
hams
|
13 |
|
|
|
1 |
2812d |
2811d
|
11/29 |
2753d |
63346650c1a9
netrom: switch to sock timer API
|
|
inconsistent lock state in nr_find_socket
hams
|
4 |
syz, C |
|
|
19 |
2804d |
2820d
|
11/29 |
2802d |
7314f5480f3e
netrom: fix locking in nr_find_socket()
|
|
kernel BUG at kernel/time/timer.c:LINE! (2)
hams
|
-1 |
syz, C |
|
|
5 |
2815d |
2817d
|
11/29 |
2802d |
202700e30740
net/hamradio/6pack: use mod_timer() to rearm timers
|
|
KASAN: use-after-free Read in nr_rx_frame
hams
|
19 |
syz |
|
|
2 |
2809d |
2816d
|
11/29 |
2802d |
7314f5480f3e
netrom: fix locking in nr_find_socket()
|
|
possible deadlock in nr_destroy_socket
hams
|
4 |
syz |
|
|
20 |
2806d |
2816d
|
11/29 |
2802d |
7314f5480f3e
netrom: fix locking in nr_find_socket()
|
|
KASAN: use-after-free Read in ax25_fillin_cb
hams
|
19 |
syz |
|
|
4 |
2823d |
2820d
|
11/29 |
2802d |
c433570458e4
ax25: fix a use-after-free in ax25_fillin_cb()
|