)]}'
{
  "commit": "ad41706c771a038e9a334fa55216abd69b32bfdf",
  "tree": "194fe5e1d6b1b2789718beae8a77fd6628ef86e1",
  "parents": [
    "452ea6a15ed2ac74789b7b3513777cc94ea3b751"
  ],
  "author": {
    "name": "Xiaolong Huang",
    "email": "butterflyhuangxx@gmail.com",
    "time": "Fri Aug 20 03:50:34 2021 +0800"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Fri Sep 03 10:09:21 2021 +0200"
  },
  "message": "net: qrtr: fix another OOB Read in qrtr_endpoint_post\n\ncommit 7e78c597c3ebfd0cb329aa09a838734147e4f117 upstream.\n\nThis check was incomplete, did not consider size is 0:\n\n\tif (len !\u003d ALIGN(size, 4) + hdrlen)\n                    goto err;\n\nif size from qrtr_hdr is 0, the result of ALIGN(size, 4)\nwill be 0, In case of len \u003d\u003d hdrlen and size \u003d\u003d 0\nin header this check won\u0027t fail and\n\n\tif (cb-\u003etype \u003d\u003d QRTR_TYPE_NEW_SERVER) {\n                /* Remote node endpoint can bridge other distant nodes */\n                const struct qrtr_ctrl_pkt *pkt \u003d data + hdrlen;\n\n                qrtr_node_assign(node, le32_to_cpu(pkt-\u003eserver.node));\n        }\n\nwill also read out of bound from data, which is hdrlen allocated block.\n\nFixes: 194ccc88297a (\"net: qrtr: Support decoding incoming v2 packets\")\nFixes: ad9d24c9429e (\"net: qrtr: fix OOB Read in qrtr_endpoint_post\")\nSigned-off-by: Xiaolong Huang \u003cbutterflyhuangxx@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "6826558483f973b44a1bad04af1350e5817a5873",
      "old_mode": 33188,
      "old_path": "net/qrtr/qrtr.c",
      "new_id": "56cffbfa000b7900a86ba83e2fc1111ffe701790",
      "new_mode": 33188,
      "new_path": "net/qrtr/qrtr.c"
    }
  ]
}