iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4c572d8b5fd01af0b6a1e41dff733e97fffcf7fd
linux/net/sched
History
Cong Wang 9f8b6c44be net_sched: keep alloc_hash updated after hash allocation 
[ Upstream commit 0d1c3530e1 ]

In commit 599be01ee5 ("net_sched: fix an OOB access in cls_tcindex")
I moved cp->hash calculation before the first
tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched.
This difference could lead to another out of bound access.

cp->alloc_hash should always be the size allocated, we should
update it after this tcindex_alloc_perfect_hash().

Reported-and-tested-by: syzbot+dcc34d54d68ef7d2d53d@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+c72da7b9ed57cde6fca2@syzkaller.appspotmail.com
Fixes: 599be01ee5 ("net_sched: fix an OOB access in cls_tcindex")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 16:34:24 +02:00
..
act_api.c
net: avoid potential infinite loop in tc_ctl_action()
2019-10-29 09:17:03 +01:00
act_bpf.c
net_sched: fix a NULL pointer deref in ipt action
2019-09-10 10:32:20 +01:00
act_connmark.c
net_sched: fix a NULL pointer deref in ipt action
2019-09-10 10:32:20 +01:00
act_csum.c
net_sched: fix a NULL pointer deref in ipt action
2019-09-10 10:32:20 +01:00
act_gact.c
net_sched: fix a NULL pointer deref in ipt action
2019-09-10 10:32:20 +01:00
act_ife.c
net_sched: fix a NULL pointer deref in ipt action
2019-09-10 10:32:20 +01:00
act_ipt.c
net_sched: fix a NULL pointer deref in ipt action
2019-09-10 10:32:20 +01:00
act_meta_mark.c
…
act_meta_skbprio.c
…
act_meta_skbtcindex.c
net sched ife action: Introduce skb tcindex metadata encap decap
2016-09-19 21:55:28 -04:00
act_mirred.c
act_mirred: Fix mirred_init_module error handling
2020-01-27 14:46:49 +01:00
act_nat.c
net_sched: fix a NULL pointer deref in ipt action
2019-09-10 10:32:20 +01:00
act_pedit.c
net/sched: act_pedit: fix WARN() in the traffic path
2019-12-01 09:13:11 +01:00
act_police.c
net_sched: fix a NULL pointer deref in ipt action
2019-09-10 10:32:20 +01:00
act_sample.c
net/sched: act_sample: don't push mac header on ip6gre ingress
2019-10-05 12:47:40 +02:00
act_simple.c
net_sched: fix a NULL pointer deref in ipt action
2019-09-10 10:32:20 +01:00
act_skbedit.c
net_sched: fix a NULL pointer deref in ipt action
2019-09-10 10:32:20 +01:00
act_skbmod.c
net_sched: fix a NULL pointer deref in ipt action
2019-09-10 10:32:20 +01:00
act_tunnel_key.c
net_sched: fix a NULL pointer deref in ipt action
2019-09-10 10:32:20 +01:00
act_vlan.c
net_sched: fix a NULL pointer deref in ipt action
2019-09-10 10:32:20 +01:00
cls_api.c
net_sched: refetch skb protocol for each filter
2019-01-31 08:13:41 +01:00
cls_basic.c
cls_basic: use tcf_exts_get_net() before call_rcu()
2017-11-09 10:03:09 +09:00
cls_bpf.c
cls_bpf: don't decrement net's refcount when offload fails
2017-12-17 15:07:59 +01:00
cls_cgroup.c
cls_cgroup: use tcf_exts_get_net() before call_rcu()
2017-11-09 10:03:09 +09:00
cls_flow.c
cls_flow: use tcf_exts_get_net() before call_rcu()
2017-11-09 10:03:09 +09:00
cls_flower.c
net: sched: correct flower port blocking
2020-03-11 18:02:48 +01:00
cls_fw.c
cls_fw: use tcf_exts_get_net() before call_rcu()
2017-11-09 10:03:09 +09:00
cls_matchall.c
net/sched: matchall: add missing validation of TCA_MATCHALL_FLAGS
2020-02-28 16:36:09 +01:00
cls_route.c
net_sched: cls_route: remove the right filter from hashtable
2020-04-02 16:34:24 +02:00
cls_rsvp6.c
…
cls_rsvp.c
…
cls_rsvp.h
cls_rsvp: fix rsvp_policy
2020-02-14 16:32:06 -05:00
cls_tcindex.c
net_sched: keep alloc_hash updated after hash allocation
2020-04-02 16:34:24 +02:00
cls_u32.c
net: sched: Fix memory exposure from short TCA_U32_SEL
2018-09-15 09:45:24 +02:00
em_canid.c
…
em_cmp.c
…
em_ipset.c
netfilter: x_tables: move hook state into xt_action_param structure
2016-11-03 10:56:21 +01:00
em_meta.c
net: convert sock.sk_refcnt from atomic_t to refcount_t
2017-07-01 07:39:08 -07:00
em_nbyte.c
…
em_text.c
…
em_u32.c
…
ematch.c
net_sched: ematch: reject invalid TCF_EM_SIMPLE
2020-02-05 14:18:09 +00:00
Kconfig
net: sched: select cls when cls_act is enabled
2017-06-05 10:56:36 -04:00
Makefile
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
sch_api.c
net_sched: check cops->tcf_block in tc_bind_tclass()
2019-11-06 12:43:22 +01:00
sch_atm.c
net_sched: remove tc class reference counting
2017-08-25 17:19:10 -07:00
sch_blackhole.c
net_sched: blackhole: tell upper qdisc about dropped packets
2018-07-22 14:28:46 +02:00
sch_cbq.c
sch_cbq: validate TCA_CBQ_WRROPT to avoid crash
2019-10-07 18:55:21 +02:00
sch_choke.c
net_sched: red: Avoid illegal values
2018-02-25 11:07:59 +01:00
sch_codel.c
net: sched: Fix a possible null-pointer dereference in dequeue_func()
2019-08-09 17:53:35 +02:00
sch_drr.c
net_sched: remove tc class reference counting
2017-08-25 17:19:10 -07:00
sch_dsmark.c
sch_dsmark: fix potential NULL deref in dsmark_init()
2019-10-07 18:55:19 +02:00
sch_fifo.c
sched: don't use skb queue helpers
2016-09-19 01:47:18 -04:00
sch_fq_codel.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-09-01 17:42:05 -07:00
sch_fq.c
net: fq: add missing attribute validation for orphan mask
2020-03-20 10:54:11 +01:00
sch_generic.c
net_sched: let qdisc_put() accept NULL pointer
2019-09-21 07:15:28 +02:00
sch_gred.c
net: sched: gred: pass the right attribute to gred_change_table_def()
2018-11-04 14:52:48 +01:00
sch_hfsc.c
net_sched/hfsc: fix curve activation in hfsc_change_class()
2017-09-21 11:56:32 -07:00
sch_hhf.c
net/flow_dissector: switch to siphash
2019-11-10 11:25:37 +01:00
sch_htb.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-09-01 17:42:05 -07:00
sch_ingress.c
net: sched: fix static key imbalance in case of ingress/clsact_init error
2018-01-02 20:31:12 +01:00
sch_mq.c
net: sched: fix tc -s class show no bstats on class with nolock subqueues
2019-12-05 15:38:19 +01:00
sch_mqprio.c
net: sched: fix tc -s class show no bstats on class with nolock subqueues
2019-12-05 15:38:19 +01:00
sch_multiq.c
net: sched: fix tc -s class show no bstats on class with nolock subqueues
2019-12-05 15:38:19 +01:00
sch_netem.c
net: netem: correct the parent's backlog when corrupted packet was dropped
2020-01-27 14:46:50 +01:00
sch_pie.c
netlink: pass extended ACK struct to parsing functions
2017-04-13 13:58:22 -04:00
sch_plug.c
net_sched: drop packets after root qdisc lock is released
2016-06-25 12:19:35 -04:00
sch_prio.c
net: sch_prio: When ungrafting, replace with FIFO
2020-01-12 12:12:08 +01:00
sch_qfq.c
sched: Use __qdisc_drop instead of kfree_skb in sch_prio and sch_qfq
2017-09-06 21:20:07 -07:00
sch_red.c
net: sched: red: avoid hashing NULL child
2018-05-25 16:17:23 +02:00
sch_sfb.c
net/flow_dissector: switch to siphash
2019-11-10 11:25:37 +01:00
sch_sfq.c
net/flow_dissector: switch to siphash
2019-11-10 11:25:37 +01:00
sch_tbf.c
net: create skb_gso_validate_mac_len()
2019-02-20 10:20:48 +01:00
sch_teql.c
net: make ndo_get_stats64 a void function
2017-01-08 17:51:44 -05:00