iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/ipv4
History
Neal Cardwell 1c95df85ca inet_diag: fix oops for IPv4 AF_INET6 TCP SYN-RECV state 
Fix inet_diag to be aware of the fact that AF_INET6 TCP connections
instantiated for IPv4 traffic and in the SYN-RECV state were actually
created with inet_reqsk_alloc(), instead of inet6_reqsk_alloc(). This
means that for such connections inet6_rsk(req) returns a pointer to a
random spot in memory up to roughly 64KB beyond the end of the
request_sock.

With this bug, for a server using AF_INET6 TCP sockets and serving
IPv4 traffic, an inet_diag user like `ss state SYN-RECV` would lead to
inet_diag_fill_req() causing an oops or the export to user space of 16
bytes of kernel memory as a garbage IPv6 address, depending on where
the garbage inet6_rsk(req) pointed.

Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-12-09 18:59:37 -05:00
..
netfilter
netfilter: nf_nat: don't check for port change on ICMP tuples
2012-10-28 22:43:34 +01:00
af_inet.c
ipv4: Don't add TCP-code in inet_sock_destruct
2012-09-20 17:12:27 -04:00
ah4.c
ipv4: Add redirect support to all protocol icmp error handlers.
2012-07-11 21:27:49 -07:00
arp.c
ipv4/route: arg delay is useless in rt_cache_flush()
2012-09-18 15:44:34 -04:00
cipso_ipv4.c
cipso: don't follow a NULL pointer when setsockopt() is called
2012-07-18 09:01:12 -07:00
datagram.c
ipv4: Lock socket and use cork flow in ip4_datagram_connect().
2011-05-08 13:48:57 -07:00
devinet.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2012-09-28 14:40:49 -04:00
esp4.c
ipv4: Add redirect support to all protocol icmp error handlers.
2012-07-11 21:27:49 -07:00
fib_frontend.c
ipv4: fix sending of redirects
2012-10-08 17:42:35 -04:00
fib_lookup.h
ipv4: Fix nexthop caching wrt. scoping.
2011-03-24 18:06:47 -07:00
fib_rules.c
sections: fix section conflicts in net
2012-10-06 03:04:45 +09:00
fib_semantics.c
ipv4: make sure nh_pcpu_rth_output is always allocated
2012-10-08 17:42:35 -04:00
fib_trie.c
ipv4/route: arg delay is useless in rt_cache_flush()
2012-09-18 15:44:34 -04:00
gre.c
net: ipv4: Standardize prefixes for message logging
2012-03-12 17:05:21 -07:00
icmp.c
ipv4: avoid passing NULL to inet_putpeer() in icmpv4_xrlim_allow()
2012-11-26 17:24:41 -05:00
igmp.c
igmp: export symbol ip_mc_leave_group
2012-10-01 18:39:44 -04:00
inet_connection_sock.c
ipv4: introduce rt_uses_gateway
2012-10-08 17:42:36 -04:00
inet_diag.c
inet_diag: fix oops for IPv4 AF_INET6 TCP SYN-RECV state
2012-12-09 18:59:37 -05:00
inet_fragment.c
ipv6: unify fragment thresh handling code
2012-09-19 17:23:28 -04:00
inet_hashtables.c
ipv4: fix checkpatch errors
2012-04-15 12:37:19 -04:00
inet_lro.c
net: add skb frag size accessors
2011-10-19 03:10:46 -04:00
inet_timewait_sock.c
net: ipv4 and ipv6: Convert printk(KERN_DEBUG to pr_debug
2012-05-16 01:01:03 -04:00
inetpeer.c
Merge branch 'for-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
2012-10-02 09:54:49 -07:00
ip_forward.c
ipv4: introduce rt_uses_gateway
2012-10-08 17:42:36 -04:00
ip_fragment.c
ipv6: unify fragment thresh handling code
2012-09-19 17:23:28 -04:00
ip_gre.c
gre: fix sparse warning
2012-10-01 17:35:31 -04:00
ip_input.c
net: TCP early demux cleanup
2012-07-30 14:53:21 -07:00
ip_options.c
ipv4: optimize fib_compute_spec_dst call in ip_options_echo
2012-07-19 08:30:49 -07:00
ip_output.c
ipv4: introduce rt_uses_gateway
2012-10-08 17:42:36 -04:00
ip_sockglue.c
ipv4: avoid undefined behavior in do_ip_setsockopt()
2012-11-11 17:53:13 -05:00
ip_vti.c
ipv4/ip_vti.c: VTI fix post-decryption forwarding
2012-11-14 21:40:21 -05:00
ipcomp.c
ipv4: Add redirect support to all protocol icmp error handlers.
2012-07-11 21:27:49 -07:00
ipconfig.c
ipconfig: fix trivial build error
2012-09-25 13:22:30 -04:00
ipip.c
tunnel: drop packet if ECN present with not-ECT
2012-09-27 18:12:37 -04:00
ipmr.c
net: ipmr: limit MRT_TABLE identifiers
2012-11-26 17:36:59 -05:00
Kconfig
net/ipv4: VTI support new module for ip_vti.
2012-07-18 09:36:12 -07:00
Makefile
memcg: rename config variables
2012-07-31 18:42:43 -07:00
netfilter.c
netfilter: properly annotate ipv4_netfilter_{init,fini}()
2012-09-03 13:56:04 +02:00
ping.c
userns: Use kgids for sysctl_ping_group_range
2012-08-14 21:49:10 -07:00
proc.c
tcp: TCP Fast Open Server - header & support functions
2012-08-31 20:02:18 -04:00
protocol.c
inet: Sanitize inet{,6} protocol demux.
2012-06-19 18:56:21 -07:00
raw.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2012-10-02 11:11:09 -07:00
route.c
ipv4: do not cache looped multicasts
2012-11-22 16:06:49 -05:00
syncookies.c
tcp: TCP Fast Open Server - support TFO listeners
2012-08-31 20:02:19 -04:00
sysctl_net_ipv4.c
tcp: sysctl interface leaks 16 bytes of kernel memory
2012-10-11 15:12:33 -04:00
tcp_bic.c
tcp: fix undo after RTO for BIC
2012-01-20 14:17:26 -05:00
tcp_cong.c
tcp: Apply device TSO segment limit earlier
2012-08-02 00:19:17 -07:00
tcp_cubic.c
tcp: fix undo after RTO for CUBIC
2012-01-20 14:17:26 -05:00
tcp_diag.c
inet_diag: Rename inet_diag_req into inet_diag_req_v2
2012-01-11 12:56:06 -08:00
tcp_fastopen.c
tcp: TCP Fast Open Server - header & support functions
2012-08-31 20:02:18 -04:00
tcp_highspeed.c
tcp: mark tcp_congestion_ops read_mostly
2011-03-10 00:40:17 -08:00
tcp_htcp.c
tcp: mark tcp_congestion_ops read_mostly
2011-03-10 00:40:17 -08:00
tcp_hybla.c
tcp: bool conversions
2012-05-17 14:59:59 -04:00
tcp_illinois.c
net: fix divide by zero in tcp algorithm illinois
2012-11-01 11:55:59 -04:00
tcp_input.c
tcp: bug fix Fast Open client retransmission
2012-12-07 14:39:28 -05:00
tcp_ipv4.c
tcp: add SYN/data info to TCP_INFO
2012-10-22 15:16:06 -04:00
tcp_lp.c
Fix common misspellings
2011-03-31 11:26:23 -03:00
tcp_memcontrol.c
memcg: decrement static keys at real destroy time
2012-05-29 16:22:28 -07:00
tcp_metrics.c
tcp: handle tcp_net_metrics_init() order-5 memory allocation failures
2012-11-16 13:36:27 -05:00
tcp_minisocks.c
tcp: add SYN/data info to TCP_INFO
2012-10-22 15:16:06 -04:00
tcp_output.c
tcp: bug fix Fast Open client retransmission
2012-12-07 14:39:28 -05:00
tcp_probe.c
net: cleanup unsigned to unsigned int
2012-04-15 12:44:40 -04:00
tcp_scalable.c
tcp: mark tcp_congestion_ops read_mostly
2011-03-10 00:40:17 -08:00
tcp_timer.c
tcp: Reject invalid ack_seq to Fast Open sockets
2012-10-23 02:42:56 -04:00
tcp_vegas.c
tcp: mark tcp_congestion_ops read_mostly
2011-03-10 00:40:17 -08:00
tcp_vegas.h
…
tcp_veno.c
tcp: mark tcp_congestion_ops read_mostly
2011-03-10 00:40:17 -08:00
tcp_westwood.c
tcp: mark tcp_congestion_ops read_mostly
2011-03-10 00:40:17 -08:00
tcp_yeah.c
Fix common misspellings
2011-03-31 11:26:23 -03:00
tcp.c
tcp: fix crashes in do_tcp_sendpages()
2012-12-01 20:39:16 -05:00
tunnel4.c
net: Convert printks to pr_<level>
2012-03-11 23:42:51 -07:00
udp_diag.c
netlink: Rename pid to portid to avoid confusion
2012-09-10 15:30:41 -04:00
udp_impl.h
ipv4: fix checkpatch errors
2012-04-15 12:37:19 -04:00
udp.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2012-10-02 11:11:09 -07:00
udplite.c
net: ipv4: Standardize prefixes for message logging
2012-03-12 17:05:21 -07:00
xfrm4_input.c
ipv4: Fix input route performance regression.
2012-07-26 15:50:39 -07:00
xfrm4_mode_beet.c
ipsec: be careful of non existing mac headers
2012-02-23 16:50:45 -05:00
xfrm4_mode_transport.c
…
xfrm4_mode_tunnel.c
net/ipv4: VTI support rx-path hook in xfrm4_mode_tunnel.
2012-07-18 09:36:12 -07:00
xfrm4_output.c
xfrm4: Don't call icmp_send on local error
2011-07-01 17:33:19 -07:00
xfrm4_policy.c
xfrm: Fix the gc threshold value for ipv4
2012-11-13 09:15:07 +01:00
xfrm4_state.c
net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules
2011-10-31 19:30:30 -04:00
xfrm4_tunnel.c
net: ipv4: Standardize prefixes for message logging
2012-03-12 17:05:21 -07:00