Hannes Frederic Sowa 2811ebac25 ipv6: udp packets following an UFO enqueued packet need also be handled by UFO ... In the following scenario the socket is corked: If the first UDP packet is larger then the mtu we try to append it to the write queue via ip6_ufo_append_data. A following packet, which is smaller than the mtu would be appended to the already queued up gso-skb via plain ip6_append_data. This causes random memory corruptions. In ip6_ufo_append_data we also have to be careful to not queue up the same skb multiple times. So setup the gso frame only when no first skb is available. This also fixes a shortcoming where we add the current packet's length to cork->length but return early because of a packet > mtu with dontfrag set (instead of sutracting it again). Found with trinity. Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-09-24 11:43:05 -04:00
..
9p	for-linus-3.12-merge minor 9p fixes and tweaks for 3.12 merge window	2013-09-11 12:34:13 -07:00
802	mrp: add periodictimer to allow retries when packets get lost	2013-09-23 16:53:52 -04:00
8021q	net: vlan: inherit addr_assign_type along with dev_addr	2013-09-03 20:57:49 -04:00
appletalk	net: proc_fs: trivial: print UIDs as unsigned int	2013-08-15 14:37:46 -07:00
atm
ax25
batman-adv	batman-adv: set the TAG flag for the vid passed to BLA	2013-09-17 21:15:16 +02:00
bluetooth	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid	2013-09-06 09:30:36 -07:00
bridge	bridge: fix NULL pointer deref of br_port_get_rcu	2013-09-15 22:03:33 -04:00
caif	caif: Add missing braces to multiline if in cfctrl_linkup_request	2013-09-05 14:31:02 -04:00
can	can: gw: add a per rule limitation of frame hops	2013-08-29 22:58:24 +02:00
ceph	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client	2013-09-19 12:50:37 -05:00
core	netpoll: fix NULL pointer dereference in netpoll_cleanup	2013-09-19 14:15:53 -04:00
dcb
dccp	net:dccp: do not report ICMP redirects to user space	2013-09-18 12:33:44 -04:00
decnet
dns_resolver	net: strict_strtoul is obsolete, use kstrtoul instead	2013-07-12 16:09:14 -07:00
dsa	net: dsa: inherit addr_assign_type along with dev_addr	2013-09-03 20:57:49 -04:00
ethernet	net: Fix sysfs_format_mac() code duplication.	2013-07-16 17:09:22 -07:00
ieee802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-09-05 14:54:29 -07:00
ipv4	net: raw: do not report ICMP redirects to user space	2013-09-24 10:15:49 -04:00
ipv6	ipv6: udp packets following an UFO enqueued packet need also be handled by UFO	2013-09-24 11:43:05 -04:00
ipx	net: proc_fs: trivial: print UIDs as unsigned int	2013-08-15 14:37:46 -07:00
irda	net/irda: fixed style issues in irttp	2013-07-19 17:34:40 -07:00
iucv	net: delete __cpuinit usage from all net files	2013-07-14 19:36:58 -04:00
key	xfrm: Remove rebundant address family checking	2013-08-07 10:12:58 +02:00
l2tp	l2tp: make datapath resilient to packet loss when sequence numbers enabled	2013-07-02 16:33:25 -07:00
lapb	net/lapb: re-send packets on timeout	2013-09-23 16:52:45 -04:00
llc	llc: Use normal etherdevice.h tests	2013-09-03 22:34:47 -04:00
mac80211	Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next	2013-08-28 13:51:40 -04:00
mac802154
mpls
netfilter	ip: generate unique IP identificator if local fragmentation is allowed	2013-09-19 14:11:15 -04:00
netlabel	netlabel: use domain based selectors when address based selectors are not available	2013-08-02 16:57:01 -07:00
netlink	net: netlink: filter particular protocols from analyzers	2013-09-06 14:43:48 -04:00
netrom
nfc	NFC: Update secure element state	2013-08-14 01:13:40 +02:00
openvswitch	net: ovs: flow: fix potential illegal memory access in __parse_flow_nlattrs	2013-09-11 16:09:58 -04:00
packet	net: packet: use reciprocal_divide in fanout_demux_hash	2013-08-29 16:43:29 -04:00
phonet	net: proc_fs: trivial: print UIDs as unsigned int	2013-08-15 14:37:46 -07:00
rds
rfkill	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-09-05 14:54:29 -07:00
rose
rxrpc
sched	net_sched: htb: fix a typo in htb_change_class()	2013-09-11 17:16:22 -04:00
sctp	net: sctp: rfc4443: do not report ICMP redirects to user space	2013-09-16 21:40:15 -04:00
sunrpc	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-09-12 15:01:38 -07:00
tipc	tipc: set sk_err correctly when connection fails	2013-08-30 16:06:57 -04:00
unix	af_unix: fix bug on large send()	2013-08-11 22:02:36 -07:00
vmw_vsock	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-08-16 15:37:26 -07:00
wimax
wireless	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-09-05 14:54:29 -07:00
x25	x25: add a sanity check parsing X.25 facilities	2013-09-04 00:27:27 -04:00
xfrm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-09-05 14:58:52 -04:00
compat.c
Kconfig	Remove GENERIC_HARDIRQ config option	2013-09-13 15:09:52 +02:00
Makefile
nonet.c
socket.c	Merge git://git.kvack.org/~bcrl/aio-next	2013-09-13 10:55:58 -07:00
sysctl_net.c