)]}'
{
  "commit": "c7ead9704249d57d4693a04697e3bbd285138fa9",
  "tree": "f538181ad1f21091e6c20044be43271b5e26376d",
  "parents": [
    "31550d585589fde1ae95bf7f7a8188b2d2fdf1c7"
  ],
  "author": {
    "name": "Guanglei Zhu",
    "email": "zhugl3@xiaopeng.com",
    "time": "Fri Sep 11 10:17:34 2026 +0800"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Wed Sep 16 18:58:45 2026 -0700"
  },
  "message": "net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()\n\nThe netif index carried in the DPMAIF PIT header is five bits wide,\nbut ccmni_inst[] only has room for NIC_DEV_MAX (21) entries.\nt7xx_ccmni_recv_skb() indexes the array without a bounds check, so\nindexes 21 to 31 read past it.  The out-of-bounds value lands in the\ncallback table that follows the array, which is never NULL, so the\nexisting !ccmni check does not catch it and the driver dereferences\nwhatever sits there as a struct t7xx_ccmni.\n\nDrop the skb when the index is out of range.\n\nFixes: 05d19bf500f8 (\"net: wwan: t7xx: Add WWAN network interface\")\nCc: stable@vger.kernel.org\nSigned-off-by: Guanglei Zhu \u003czhugl3@xiaopeng.com\u003e\n\nVerified in a QEMU guest with a fault injector setting the netif\nindex to 25: the unpatched driver reads a value past ccmni_inst[],\nwhich lands in the callback table, and dereferences it far enough to\nqueue the skb.  With this check the packet is dropped.  Well-formed\ntraffic on index 0 is unaffected.\n\nChanges in v2: none.\n\nLink: https://patch.msgid.link/20260911021734.1396599-3-zhugl3@xiaopeng.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "fc0a7cb181df2c8af2b2cc746d59d458bb0c780a",
      "old_mode": 33188,
      "old_path": "drivers/net/wwan/t7xx/t7xx_netdev.c",
      "new_id": "8f32c2d269312912b1b36e7b984b66ba581b75a4",
      "new_mode": 33188,
      "new_path": "drivers/net/wwan/t7xx/t7xx_netdev.c"
    }
  ]
}