renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-24 21:24:00 +08:00
Code
5e34af4142
linux-next/net
History
Tadeusz Struk 5e34af4142 net: ipv6: fix skb_over_panic in __ip6_append_data 
Syzbot found a kernel bug in the ipv6 stack:
LINK: https://syzkaller.appspot.com/bug?id=205d6f11d72329ab8d62a610c44c5e7e25415580
The reproducer triggers it by sending a crafted message via sendmmsg()
call, which triggers skb_over_panic, and crashes the kernel:

skbuff: skb_over_panic: text:ffffffff84647fb4 len:65575 put:65575
head:ffff888109ff0000 data:ffff888109ff0088 tail:0x100af end:0xfec0
dev:<NULL>

Update the check that prevents an invalid packet with MTU equal
to the fregment header size to eat up all the space for payload.

The reproducer can be found here:
LINK: https://syzkaller.appspot.com/text?tag=ReproC&x=1648c83fb00000

Reported-by: syzbot+e223cf47ec8ae183f2a0@syzkaller.appspotmail.com
Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Acked-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20220310232538.1044947-1-tadeusz.struk@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-03-11 17:11:38 -08:00
..
6lowpan
9p xen/9p: use alloc/free_pages_exact() 2022-03-07 09:48:55 +01:00
802 net: 802: Use memset_startat() to clear struct fields 2021-11-19 11:23:23 +00:00
8021q vlan: move dev_put into vlan_dev_uninit 2022-02-09 13:33:39 +00:00
appletalk
atm proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
ax25 ax25: Fix NULL pointer dereference in ax25_kill_by_device 2022-03-09 12:45:02 +00:00
batman-adv batman-adv: Don't expect inter-netns unique iflink indices 2022-03-02 09:24:55 +01:00
bluetooth Bluetooth: hci_sync: Fix not processing all entries on cmd_sync_work 2022-03-03 13:30:03 +01:00
bpf bpf: Add dummy BPF STRUCT_OPS for test purpose 2021-11-01 14:10:00 -07:00
bpfilter
bridge net: bridge: multicast: notify switchdev driver whenever MC processing gets disabled 2022-02-16 20:35:00 -08:00
caif Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2021-12-31 14:35:40 +00:00
can net-timestamp: convert sk->sk_tskey to atomic_t 2022-02-18 11:14:52 +00:00
ceph libceph: optionally use bounce buffer on recv path in crc mode 2022-02-02 18:50:36 +01:00
core xdp: xdp_mem_allocator can be NULL in trace_mem_connect(). 2022-03-10 16:09:29 -08:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-03 08:01:55 -08:00
dccp dccp: Inline dccp_listen_start(). 2021-11-23 20:16:22 -08:00
decnet Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2021-12-31 14:35:40 +00:00
dns_resolver
dsa net: dsa: unlock the rtnl_mutex when dsa_master_setup() fails 2022-03-06 10:55:54 +00:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2021-11-24 17:21:42 -08:00
ethtool ethtool: use phydev variable 2022-01-06 12:33:35 +00:00
hsr net: Write lock dev_base_lock without disabling bottom halves. 2021-11-29 12:12:36 +00:00
ieee802154 net: ieee802154: Return meaningful error codes from the netlink helpers 2022-01-27 08:20:47 +01:00
ife
ipv4 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 2022-03-09 14:48:11 +00:00
ipv6 net: ipv6: fix skb_over_panic in __ip6_append_data 2022-03-11 17:11:38 -08:00
iucv net: Don't include filter.h from net/sock.h 2021-12-29 08:48:14 -08:00
kcm net: Don't include filter.h from net/sock.h 2021-12-29 08:48:14 -08:00
key xfrm: Check if_id in xfrm_migrate 2022-01-26 07:44:01 +01:00
l2tp l2tp: add netns refcount tracker to l2tp_dfs_seq_data 2021-12-10 06:38:27 -08:00
l3mdev
lapb
llc sock: Use sock_owned_by_user_nocheck() instead of sk_lock.owned. 2021-12-10 19:43:00 -08:00
mac80211 mac80211: treat some SAE auth steps as final 2022-03-01 11:33:13 +01:00
mac802154 mac802154: use dev_addr_set() - manual 2021-10-20 14:27:40 +01:00
mctp mctp: fix use after free 2022-02-15 14:54:40 +00:00
mpls net: mpls: Fix GCC 12 warning 2022-02-10 15:29:39 +00:00
mptcp mptcp: Correctly set DATA_FIN timeout when number of retransmits is large 2022-02-24 21:54:54 -08:00
ncsi all: replace find_next{,_zero}_bit with find_first{,_zero}_bit where appropriate 2022-01-15 08:47:31 -08:00
netfilter net/sched: act_ct: Fix flow table lookup failure with no originating ifindex 2022-03-01 22:08:31 +01:00
netlabel lsm: security_task_getsecid_subj() -> security_current_getsecid_subj() 2021-11-22 17:52:47 -05:00
netlink net: Don't include filter.h from net/sock.h 2021-12-29 08:48:14 -08:00
netrom netrom: fix api breakage in nr_setsockopt() 2022-01-07 14:11:05 +00:00
nfc Networking fixes for 5.17-rc1, including fixes from netfilter, bpf. 2022-01-20 10:57:05 +02:00
nsh
openvswitch openvswitch: Fix setting ipv6 fields causing hw csum failure 2022-02-24 09:16:21 -08:00
packet af_packet: fix data-race in packet_setsockopt / packet_setsockopt 2022-02-01 20:21:10 -08:00
phonet phonet/pep: refuse to enable an unbound pipe 2021-12-20 11:49:51 +00:00
psample
qrtr bus: mhi: core: Add an API for auto queueing buffers for DL channel 2021-12-17 17:17:14 +01:00
rds Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2021-12-16 16:13:19 -08:00
rfkill rfkill: allow to get the software rfkill state 2021-12-20 11:02:38 +01:00
rose net: Don't include filter.h from net/sock.h 2021-12-29 08:48:14 -08:00
rxrpc rxrpc: Adjust retransmission backoff 2022-01-22 02:03:24 +00:00
sched Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 2022-03-01 15:13:47 -08:00
sctp sctp: fix kernel-infoleak for SCTP sockets 2022-03-10 14:46:42 -08:00
smc net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server 2022-03-03 10:34:18 +00:00
strparser bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-09 01:05:28 +01:00
sunrpc SUNRPC: lock against ->sock changing during sysfs read 2022-02-08 09:14:26 -05:00
switchdev net: switchdev: add net device refcount tracker 2021-12-07 20:44:58 -08:00
tipc tipc: fix incorrect order of state message data sanity check 2022-03-08 22:18:42 -08:00
tls net/tls: Fix another skb memory leak when running kTLS traffic 2022-01-17 13:07:47 +00:00
unix af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress 2022-01-14 18:31:37 -08:00
vmw_vsock vsock: remove vsock from connected table when connect is interrupted by a signal 2022-02-17 08:56:02 -08:00
wireless nl80211: Update bss channel on channel switch for P2P_CLIENT 2022-03-02 22:37:05 +01:00
x25 net: x25: drop harmless check of !more 2021-12-09 18:35:11 -08:00
xdp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-01-05 14:36:10 -08:00
xfrm Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" 2022-03-06 08:38:28 +01:00
compat.c
devres.c
Kconfig net: kunit: add a test for dev_addr_lists 2021-11-20 12:25:57 +00:00
Kconfig.debug net: add networking namespace refcount tracker 2021-12-10 06:38:26 -08:00
Makefile
socket.c net: fix documentation for kernel_getsockname 2022-02-14 14:01:19 +00:00
sysctl_net.c sections: move and rename core_kernel_data() to is_kernel_core_data() 2021-11-09 10:02:50 -08:00