iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a69b951c839836bfcb2995ecfd5e13d7476b033d
linux/net/ipv4
History
Eric Dumazet 3e48f741e9 igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU 
commit c3b704d4a4 upstream.

This is a follow up of commit 915d975b2f ("net: deal with integer
overflows in kmalloc_reserve()") based on David Laight feedback.

Back in 2010, I failed to realize malicious users could set dev->mtu
to arbitrary values. This mtu has been since limited to 0x7fffffff but
regardless of how big dev->mtu is, it makes no sense for igmpv3_newpack()
to allocate more than IP_MAX_MTU and risk various skb fields overflows.

Fixes: 57e1ab6ead ("igmp: refine skb allocations")
Link: https://lore.kernel.org/netdev/d273628df80f45428e739274ab9ecb72@AcuMS.aculab.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: David Laight <David.Laight@ACULAB.COM>
Cc: Kyle Zeng <zengyhkyle@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-09-19 12:22:49 +02:00
..
bpfilter
net: Revert "net: optimize the sockptr_t for unified kernel/user address spaces"
2020-08-10 12:06:44 -07:00
netfilter
netfilter: tproxy: fix deadlock due to missing BH disable
2023-03-17 08:48:55 +01:00
af_inet.c
tcp: deny tcp_disconnect() when threads are waiting
2023-06-09 10:32:17 +02:00
ah4.c
Merge tag 'net-next-5.14' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2021-06-30 15:51:09 -07:00
arp.c
ipv4: Invalidate neighbour for broadcast address upon address addition
2022-04-13 20:59:05 +02:00
bpf_tcp_ca.c
bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs
2021-11-25 09:49:07 +01:00
cipso_ipv4.c
cipso: Fix data-races around sysctl.
2022-07-21 21:24:21 +02:00
datagram.c
udp: Update reuse->has_conns under reuseport_lock.
2022-10-29 10:12:56 +02:00
devinet.c
net: Fix data-races around sysctl_devconf_inherit_init_net.
2022-08-31 17:16:44 +02:00
esp4_offload.c
xfrm: Linearize the skb after offloading if needed.
2023-06-28 10:29:46 +02:00
esp4.c
net: ipv4: Use kfree_sensitive instead of kfree
2023-07-27 08:47:01 +02:00
fib_frontend.c
ipv4: Fix incorrect table ID in IOCTL path
2023-03-22 13:31:28 +01:00
fib_lookup.h
ipv4: fix data races in fib_alias_hw_flags_set
2022-02-23 12:03:10 +01:00
fib_notifier.c
…
fib_rules.c
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-08 09:04:49 +01:00
fib_semantics.c
ipv4: prevent potential spectre v1 gadget in fib_metrics_match()
2023-02-01 08:27:27 +01:00
fib_trie.c
ipv4: Fix error return code in fib_table_insert()
2022-12-02 17:41:07 +01:00
fou.c
fou: remove sparse errors
2021-08-31 12:03:33 +01:00
gre_demux.c
net: Remove the member netns_ok
2021-05-17 15:29:35 -07:00
gre_offload.c
ip_gre: add csum offload support for gre header
2021-01-29 20:39:14 -08:00
icmp.c
icmp: guard against too small mtu
2023-04-13 16:48:18 +02:00
igmp.c
igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
2023-09-19 12:22:49 +02:00
inet_connection_sock.c
tcp: annotate data-races around icsk->icsk_syn_retries
2023-07-27 08:47:03 +02:00
inet_diag.c
inet_diag: fix kernel-infoleak for UDP sockets
2021-12-22 09:32:40 +01:00
inet_fragment.c
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 11:05:35 +01:00
inet_hashtables.c
Revert "tcp: avoid the lookup process failing to get sk in ehash table"
2023-07-27 08:47:02 +02:00
inet_timewait_sock.c
Revert "tcp: avoid the lookup process failing to get sk in ehash table"
2023-07-27 08:47:02 +02:00
inetpeer.c
inetpeer: Fix data-races around sysctl.
2022-07-21 21:24:21 +02:00
ip_forward.c
ip: Fix data-races around sysctl_ip_fwd_update_priority.
2022-07-29 17:25:13 +02:00
ip_fragment.c
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 11:05:35 +01:00
ip_gre.c
erspan: do not use skb_mac_header() in ndo_start_xmit()
2023-03-30 12:47:48 +02:00
ip_input.c
xfrm: fix "disable_policy" on ipv4 early demux
2022-12-02 17:41:02 +01:00
ip_options.c
net: clean up codestyle for net/ipv4
2020-08-25 06:28:02 -07:00
ip_output.c
lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
2023-09-19 12:22:34 +02:00
ip_sockglue.c
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
2023-06-05 09:21:26 +02:00
ip_tunnel_core.c
tunnels: fix kasan splat when generating ipv4 pmtu error
2023-08-16 18:22:01 +02:00
ip_tunnel.c
net: tunnels: annotate lockless accesses to dev->needed_headroom
2023-03-22 13:31:26 +01:00
ip_vti.c
ip_vti: fix potential slab-use-after-free in decode_session6
2023-08-26 14:23:32 +02:00
ipcomp.c
Merge tag 'net-next-5.14' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2021-06-30 15:51:09 -07:00
ipconfig.c
net: ipconfig: Don't override command-line hostnames or domains
2021-06-02 13:27:03 -07:00
ipip.c
ip_tunnel: use ndo_siocdevprivate
2021-07-27 20:11:44 +01:00
ipmr_base.c
…
ipmr.c
ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
2022-02-16 12:56:29 +01:00
Kconfig
tcp: configurable source port perturb table size
2022-12-02 17:41:11 +01:00
Makefile
bpf: Clean up sockmap related Kconfigs
2021-02-26 12:28:03 -08:00
metrics.c
ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
2023-02-01 08:27:27 +01:00
netfilter.c
netfilter: Dissect flow after packet mangling
2021-04-18 22:04:16 +02:00
netlink.c
…
nexthop.c
nexthop: Fix infinite nexthop bucket dump when using maximum nexthop ID
2023-08-16 18:22:02 +02:00
ping.c
ping: fix address binding wrt vrf
2022-05-18 10:26:57 +02:00
proc.c
ip: Fix data-races around sysctl_ip_default_ttl.
2022-07-29 17:25:09 +02:00
protocol.c
net: Remove the member netns_ok
2021-05-17 15:29:35 -07:00
raw_diag.c
net: Use nlmsg_unicast() instead of netlink_unicast()
2021-07-13 09:28:29 -07:00
raw.c
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
2023-06-05 09:21:26 +02:00
route.c
ipv4: Fix data-races around sysctl_fib_multipath_hash_fields.
2022-07-29 17:25:21 +02:00
syncookies.c
mptcp: remove MPTCP 'ifdef' in TCP SYN cookies
2023-01-12 11:58:52 +01:00
sysctl_net_ipv4.c
tcp: restrict net.ipv4.tcp_app_win
2023-04-20 12:13:53 +02:00
tcp_bbr.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_bic.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_bpf.c
net: deal with most data-races in sk_wait_event()
2023-05-24 17:36:42 +01:00
tcp_cdg.c
tcp: cdg: allow tcp_cdg_release() to be called multiple times
2022-11-26 09:24:50 +01:00
tcp_cong.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_cubic.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_dctcp.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_dctcp.h
…
tcp_diag.c
…
tcp_fastopen.c
tcp: annotate data-races around fastopenq.max_qlen
2023-07-27 08:47:04 +02:00
tcp_highspeed.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_htcp.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_hybla.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_illinois.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_input.c
tcp: tcp_enter_quickack_mode() should be static
2023-09-19 12:22:32 +02:00
tcp_ipv4.c
tcp: annotate data-races around tcp_rsk(req)->ts_recent
2023-07-27 08:47:01 +02:00
tcp_lp.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_metrics.c
tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
2023-08-11 15:13:55 +02:00
tcp_minisocks.c
tcp: annotate data-races around tcp_rsk(req)->ts_recent
2023-07-27 08:47:01 +02:00
tcp_nv.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_offload.c
net, gro: Set inner transport header offset in tcp/udp GRO hook
2021-08-02 10:20:56 +01:00
tcp_output.c
tcp: annotate data-races around tcp_rsk(req)->ts_recent
2023-07-27 08:47:01 +02:00
tcp_rate.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_recovery.c
tcp: Fix data-races around sysctl_tcp_recovery.
2022-07-29 17:25:22 +02:00
tcp_scalable.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_timer.c
net: tcp: fix unexcepted socket die when snd_wnd is 0
2023-09-19 12:22:33 +02:00
tcp_ulp.c
net/ulp: use consistent error code when blocking ULP
2023-01-24 07:22:48 +01:00
tcp_vegas.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_vegas.h
…
tcp_veno.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_westwood.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp_yeah.c
tcp: add accessors to read/set tp->snd_cwnd
2022-06-14 18:36:11 +02:00
tcp.c
tcp: annotate data-races around fastopenq.max_qlen
2023-07-27 08:47:04 +02:00
tunnel4.c
net: Remove the member netns_ok
2021-05-17 15:29:35 -07:00
udp_bpf.c
bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
2023-03-17 08:48:54 +01:00
udp_diag.c
net: Use nlmsg_unicast() instead of netlink_unicast()
2021-07-13 09:28:29 -07:00
udp_impl.h
net: pass a sockptr_t into ->setsockopt
2020-07-24 15:41:54 -07:00
udp_offload.c
fou: remove sparse errors
2021-08-31 12:03:33 +01:00
udp_tunnel_core.c
net/tunnel: wait until all sk_user_data reader finish before releasing the sock
2022-12-31 13:14:19 +01:00
udp_tunnel_nic.c
udp_tunnel: Fix end of loop test in udp_tunnel_nic_unregister()
2022-03-02 11:47:59 +01:00
udp_tunnel_stub.c
udp_tunnel: add central NIC RX port offload infrastructure
2020-07-10 13:54:00 -07:00
udp.c
udp: re-score reuseport groups when connected sockets are present
2023-09-19 12:22:32 +02:00
udplite.c
udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().
2023-05-30 13:55:31 +01:00
xfrm4_input.c
xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets
2023-06-28 10:29:46 +02:00
xfrm4_output.c
…
xfrm4_policy.c
…
xfrm4_protocol.c
net: xfrm: unexport __init-annotated xfrm4_protocol_init()
2022-06-14 18:36:18 +02:00
xfrm4_state.c
…
xfrm4_tunnel.c
xfrm: remove description from xfrm_type struct
2021-06-09 09:38:52 +02:00