iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net
History
Torsten Hilbrich 758156577e vti6: Fix memory leak of skb if input policy check fails 
commit 2a9de3af21aa8c31cd68b0b39330d69f8c1e59df upstream.

The vti6_rcv function performs some tests on the retrieved tunnel
including checking the IP protocol, the XFRM input policy, the
source and destination address.

In all but one places the skb is released in the error case. When
the input policy check fails the network packet is leaked.

Using the same goto-label discard in this case to fix this problem.

Fixes: ed1efb2aefbb ("ipv6: Add support for IPsec virtual tunnel interfaces")
Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 17:20:35 +02:00
..
6lowpan
6lowpan: Off by one handling ->nexthdr
2020-01-29 10:24:22 +01:00
9p
9p/virtio: Add cleanup path in p9_virtio_init
2019-08-04 09:33:28 +02:00
802
…
8021q
vlan: fix memory leak in vlan_dev_set_egress_priority
2020-01-12 11:24:27 +01:00
appletalk
appletalk: Set error code if register_snap_client failed
2019-12-21 10:41:45 +01:00
atm
net: atm: Fix potential Spectre v1 vulnerabilities
2019-04-27 09:34:40 +02:00
ax25
ax25: enforce CAP_NET_RAW for raw sockets
2019-10-05 12:30:15 +02:00
batman-adv
batman-adv: Use explicit tvlv padding for ELP packets
2020-03-20 09:07:56 +01:00
bluetooth
Bluetooth: Fix race condition in hci_release_sock()
2020-02-05 13:05:47 +00:00
bridge
netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule
2020-01-29 10:24:24 +01:00
caif
caif: reduce stack size with KASAN
2019-05-08 07:19:07 +02:00
can
can: purge socket error queue on sock destruct
2019-07-10 09:55:33 +02:00
ceph
libceph: use kbasename() and kill ceph_file_part()
2019-08-11 12:22:15 +02:00
core
cgroup, netclassid: periodically release file_lock on classid updating
2020-03-20 09:07:37 +01:00
dcb
net: dcb: For wild-card lookups, use priority -1, not 0
2018-09-19 22:47:15 +02:00
dccp
dccp: Fix memleak in __feat_register_sp
2020-01-23 08:19:34 +01:00
decnet
decnet: fix DN_IFREQ_SIZE
2019-12-05 15:35:12 +01:00
dns_resolver
KEYS: DNS: fix parsing multiple options
2018-07-22 14:27:39 +02:00
dsa
net: dsa: Fix duplicate frames flooded by learning
2020-04-02 17:20:29 +02:00
ethernet
net: add annotations on hh->hh_len lockless accesses
2020-01-12 11:24:19 +01:00
hsr
hsr: set .netnsok flag
2020-04-02 17:20:31 +02:00
ieee802154
nl802154: add missing attribute validation for dev_type
2020-03-20 09:07:39 +01:00
ipv4
vti[6]: fix packet tx through bpf_redirect() in XinY cases
2020-04-02 17:20:34 +02:00
ipv6
vti6: Fix memory leak of skb if input policy check fails
2020-04-02 17:20:35 +02:00
ipx
ipx: call ipxitf_put() in ioctl error path
2017-05-25 15:44:41 +02:00
irda
irda: Only insert new objects into the global database via setsockopt
2018-09-15 09:43:01 +02:00
iucv
net/af_iucv: always register net_device notifier
2020-01-29 10:24:26 +01:00
kcm
kcm: switch order of device registration to fix a crash
2019-04-17 08:36:44 +02:00
key
xfrm: clean up xfrm protocol checks
2019-09-16 08:19:32 +02:00
l2tp
l2tp: Fix possible NULL pointer dereference
2020-01-29 10:24:23 +01:00
l3mdev
net: ipv6: Remove l3mdev_get_saddr6
2016-09-10 23:12:53 -07:00
lapb
lapb: fixed leak of control-blocks.
2019-06-22 08:17:22 +02:00
llc
llc: fix sk_buff refcounting in llc_conn_state_process()
2020-01-29 10:24:33 +01:00
mac80211
mac80211: mark station unauthorized before key removal
2020-04-02 17:20:33 +02:00
mac802154
net: mac802154: tx: expand tailroom if necessary
2018-09-09 20:01:19 +02:00
mpls
mpls, nospec: Sanitize array index in mpls_label_ok()
2018-03-11 16:21:34 +01:00
ncsi
net/ncsi: Improve HNCDSC AEN handler
2016-10-20 11:23:08 -04:00
netfilter
netfilter: nft_fwd_netdev: validate family and chain type
2020-04-02 17:20:35 +02:00
netlabel
netlabel: fix out-of-bounds memory accesses
2019-03-13 14:04:53 -07:00
netlink
net: netlink: cap max groups which will be considered in netlink_bind()
2020-03-11 07:53:07 +01:00
netrom
netrom: hold sock when setting skb->destructor
2019-08-04 09:33:35 +02:00
nfc
nfc: add missing attribute validation for vendor subcommand
2020-03-20 09:07:40 +01:00
openvswitch
openvswitch: support asymmetric conntrack
2019-12-21 10:42:23 +01:00
packet
packet: fix data-race in fanout_flow_is_huge()
2020-01-29 10:24:35 +01:00
phonet
phonet: fix building with clang
2019-03-23 13:19:44 +01:00
qrtr
net: qrtr: Stop rx_worker before freeing node
2019-10-05 12:30:13 +02:00
rds
net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'
2020-01-29 10:24:32 +01:00
rfkill
rfkill: Fix incorrect check to avoid NULL pointer dereference
2020-01-12 11:24:23 +01:00
rose
net: rose: fix a possible stack overflow
2019-04-03 06:24:14 +02:00
rxrpc
rxrpc: Fix service call disconnection
2020-02-14 16:31:08 -05:00
sched
net_sched: keep alloc_hash updated after hash allocation
2020-04-02 17:20:30 +02:00
sctp
sctp: move the format error check out of __sctp_sf_do_9_1_abort
2020-03-11 07:53:05 +01:00
strparser
strparser: Fix incorrect strp->need_bytes value.
2018-04-29 11:32:02 +02:00
sunrpc
sunrpc: expiry_time should be seconds not timeval
2020-02-14 16:31:03 -05:00
switchdev
switchdev: Execute bridge ndos only for bridge ports
2016-10-19 10:58:04 -04:00
tipc
tipc: set sysctl_tipc_rmem and named_timeout right range
2020-01-29 10:24:21 +01:00
unix
net: fix warning in af_unix
2019-11-28 18:28:28 +01:00
vmw_vsock
VSOCK: bind to random port for VMADDR_PORT_ANY
2019-12-05 15:34:26 +01:00
wimax
…
wireless
cfg80211: check reg_rule for NULL in handle_channel_custom()
2020-03-20 09:07:57 +01:00
x25
net/x25: fix nonblocking connect
2020-01-29 10:24:41 +01:00
xfrm
xfrm: policy: Fix doulbe free in xfrm_policy_timer
2020-04-02 17:20:34 +02:00
compat.c
sock: Make sock->sk_stamp thread-safe
2019-01-09 16:16:41 +01:00
Kconfig
…
Makefile
…
socket.c
compat_ioctl: handle SIOCOUTQNSD
2020-01-23 08:19:36 +01:00
sysctl_net.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2016-10-06 09:52:23 -07:00