Jiri Benc 2ba5af42a7 openvswitch: fix panic with multiple vlan headers ... When there are multiple vlan headers present in a received frame, the first one is put into vlan_tci and protocol is set to ETH_P_8021Q. Anything in the skb beyond the VLAN TPID may be still non-linear, including the inner TCI and ethertype. While ovs_flow_extract takes care of IP and IPv6 headers, it does nothing with ETH_P_8021Q. Later, if OVS_ACTION_ATTR_POP_VLAN is executed, __pop_vlan_tci pulls the next vlan header into vlan_tci. This leads to two things: 1. Part of the resulting ethernet header is in the non-linear part of the skb. When eth_type_trans is called later as the result of OVS_ACTION_ATTR_OUTPUT, kernel BUGs in __skb_pull. Also, __pop_vlan_tci is in fact accessing random data when it reads past the TPID. 2. network_header points into the ethernet header instead of behind it. mac_len is set to a wrong value (10), too. Reported-by: Yulong Pei <ypei@redhat.com> Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2014-08-22 11:24:04 -07:00
..
6lowpan	6lowpan: Allow 6LoWPAN to be modular	2014-08-07 11:44:18 -07:00
9p	9P: remove unnecessary break after return	2014-07-15 16:27:00 -07:00
802	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
8021q	net: Always untag vlan-tagged traffic on input.	2014-08-11 12:16:51 -07:00
appletalk	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-07-16 14:09:34 -07:00
atm	lec: Use rtnl lock/unlock when updating MTU	2014-08-21 16:31:23 -07:00
ax25	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
batman-adv	batman-adv: Fix parameter order of hlist_add_behind	2014-08-16 19:19:08 -07:00
bluetooth	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-08-06 09:38:14 -07:00
bridge	net: Always untag vlan-tagged traffic on input.	2014-08-11 12:16:51 -07:00
caif	caif: remove unnecessary break after goto	2014-07-15 16:27:01 -07:00
can	can: add hash based access to single EFF frame filters	2014-05-19 09:38:24 +02:00
ceph	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client	2014-08-13 17:43:29 -06:00
core	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-08-13 18:27:40 -06:00
dcb	dcbnl : Fix misleading dcb_app->priority explanation	2014-07-30 17:21:05 -07:00
dccp	inet: move ipv6only in sock_common	2014-07-01 23:46:21 -07:00
decnet	net: Split sk_no_check into sk_no_check_{rx,tx}	2014-05-23 16:28:53 -04:00
dns_resolver	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2014-08-06 08:06:39 -07:00
dsa	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
ethernet	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
hsr	net/hsr: Remove left-over never-true conditional code.	2014-07-11 15:04:40 -07:00
ieee802154	inet: frags: use kmem_cache for inet_frag_queue	2014-08-02 15:31:31 -07:00
ipv4	tcp: fix ssthresh and undo for consecutive short FRTO episodes	2014-08-14 14:38:55 -07:00
ipv6	net: ipv6: fib: don't sleep inside atomic lock	2014-08-22 10:54:49 -07:00
ipx	net: Split sk_no_check into sk_no_check_{rx,tx}	2014-05-23 16:28:53 -04:00
irda	irda: Fix rd_frame control field initialization in irlap_send_rd_frame()	2014-08-13 20:05:52 -07:00
iucv	af_iucv: avoid path quiesce of severed path in shutdown()	2014-07-21 20:21:40 -07:00
key	af_key: remove unnecessary break after return	2014-07-15 16:27:00 -07:00
l2tp	net: use inet6_iif instead of IP6CB()->iif	2014-07-31 22:37:06 -07:00
lapb
llc
mac80211	Merge tag 'master-2014-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next	2014-07-28 17:36:25 -07:00
mac802154	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
mpls	gre: Call gso_make_checksum	2014-06-04 22:46:38 -07:00
netfilter	netfilter: nf_tables: fix error return code	2014-08-08 16:47:29 +02:00
netlabel	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-08-06 09:38:14 -07:00
netlink	netlink: Annotate RCU locking for seq_file walker	2014-08-14 15:13:40 -07:00
netrom	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
nfc	Merge tag 'master-2014-07-31' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next	2014-08-05 13:18:20 -07:00
openvswitch	openvswitch: fix panic with multiple vlan headers	2014-08-22 11:24:04 -07:00
packet	packet: handle too big packets for PACKET_V3	2014-08-21 16:44:28 -07:00
phonet	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-06-12 14:27:40 -07:00
rfkill	Merge git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next	2014-05-22 13:58:36 -04:00
rose	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-08-06 09:38:14 -07:00
sched	cbq: now_rt removal	2014-08-19 10:58:44 -07:00
sctp	sctp: not send SCTP_PEER_ADDR_CHANGE notifications with failed probe	2014-08-21 21:33:17 -07:00
sunrpc	NFS client updates for Linux 3.17	2014-08-13 18:13:19 -06:00
tipc	tipc: Fix build.	2014-08-19 11:16:38 -07:00
unix	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-06-12 14:27:40 -07:00
vmw_vsock	vsock: Make transport the proto owner	2014-05-05 13:13:50 -04:00
wimax
wireless	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless	2014-07-25 10:22:36 -04:00
x25	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
xfrm	list: fix order of arguments for hlist_add_after(_rcu)	2014-08-06 18:01:24 -07:00
compat.c	net: sendmsg: fix NULL pointer dereference	2014-07-29 12:20:22 -07:00
Kconfig	6lowpan: introduce new net/6lowpan directory	2014-07-12 01:53:30 +02:00
Makefile	6lowpan: introduce new net/6lowpan directory	2014-07-12 01:53:30 +02:00
nonet.c
socket.c	net-timestamp: sock_tx_timestamp() fix	2014-08-06 12:38:07 -07:00
sysctl_net.c