iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net
History
Ross Lagerwall e5c13a9c75 openvswitch: Avoid OOB read when parsing flow nlattrs 
[ Upstream commit 04a4af334b971814eedf4e4a413343ad3287d9a9 ]

For nested and variable attributes, the expected length of an attribute
is not known and marked by a negative number.  This results in an OOB
read when the expected length is later used to check if the attribute is
all zeros. Fix this by using the actual length of the attribute rather
than the expected length.

Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Acked-by: Pravin B Shelar <pshelar@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-06 19:43:03 +01:00
..
6lowpan
6lowpan: iphc: reset mac_header after decompress to fix panic
2018-10-10 08:52:04 +02:00
9p
9p/net: put a lower bound on msize
2019-01-13 10:05:33 +01:00
802
…
8021q
vlan: also check phy_driver ts_info for vlan's real device
2018-04-13 19:50:25 +02:00
appletalk
…
atm
net: atm: Fix potential Spectre v1
2018-05-16 10:06:51 +02:00
ax25
ax25: fix a use-after-free in ax25_fillin_cb()
2019-01-13 10:05:27 +01:00
batman-adv
batman-adv: Expand merged fragment buffer for full packet
2018-12-13 09:21:34 +01:00
bluetooth
Bluetooth: SMP: fix crash in unpairing
2018-11-10 07:41:33 -08:00
bridge
net: Fix usage of pskb_trim_rcsum
2019-02-06 19:43:02 +01:00
caif
net: caif: Add a missing rcu_read_unlock() in caif_flow_cb
2018-09-05 09:18:34 +02:00
can
can: gw: ensure DLC boundaries after CAN frame modification
2019-01-26 09:42:45 +01:00
ceph
mm: replace get_user_pages_unlocked() write/force parameters with gup_flags
2018-12-17 21:55:16 +01:00
core
net: speed up skb_rbtree_purge()
2019-01-26 09:42:55 +01:00
dcb
net: dcb: For wild-card lookups, use priority -1, not 0
2018-09-19 22:48:58 +02:00
dccp
dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart()
2018-08-22 07:48:35 +02:00
decnet
dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
2018-02-25 11:03:38 +01:00
dns_resolver
KEYS: DNS: fix parsing multiple options
2018-07-22 14:25:54 +02:00
dsa
net: dsa: Do not suspend/resume closed slave_dev
2018-08-06 16:24:41 +02:00
ethernet
net: introduce device min_header_len
2017-02-18 16:39:27 +01:00
hsr
net/hsr: fix a warning message
2015-11-23 14:56:15 -05:00
ieee802154
ieee802154: lowpan_header_create check must check daddr
2019-01-13 10:05:27 +01:00
ipv4
net: Fix usage of pskb_trim_rcsum
2019-02-06 19:43:02 +01:00
ipv6
ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses
2019-01-26 09:42:52 +01:00
ipx
ipx: call ipxitf_put() in ioctl error path
2017-05-25 14:30:13 +02:00
irda
irda: Only insert new objects into the global database via setsockopt
2018-09-15 09:40:40 +02:00
iucv
af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers
2018-11-10 07:41:35 -08:00
key
af_key: Always verify length of provided sadb_key
2018-06-16 09:54:25 +02:00
l2tp
l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6
2018-11-10 07:41:43 -08:00
l3mdev
net: Add netif_is_l3_slave
2015-10-07 04:27:43 -07:00
lapb
…
llc
llc: do not use sk_eat_skb()
2018-12-01 09:46:34 +01:00
mac80211
mac80211: Fix condition validating WMM IE
2018-12-21 14:09:51 +01:00
mac802154
net: mac802154: tx: expand tailroom if necessary
2018-09-09 20:04:32 +02:00
mpls
mpls, nospec: Sanitize array index in mpls_label_ok()
2018-03-11 16:19:47 +01:00
netfilter
netfilter: nf_tables: fix oops when inserting an element into a verdict map
2018-12-01 09:46:40 +01:00
netlabel
netlabel: check for IPV4MASK in addrinfo_get
2018-10-20 09:52:36 +02:00
netlink
netlink: Don't shift on 64 for ngroups
2018-08-09 12:19:28 +02:00
netrom
netrom: fix locking in nr_find_socket()
2019-01-13 10:05:28 +01:00
nfc
NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
2018-09-29 03:08:51 -07:00
openvswitch
openvswitch: Avoid OOB read when parsing flow nlattrs
2019-02-06 19:43:03 +01:00
packet
packet: Do not leak dev refcounts on error exit
2019-01-26 09:42:49 +01:00
phonet
phonet: properly unshare skbs in phonet_rcv()
2016-01-31 11:29:00 -08:00
rds
rds: avoid unenecessary cong_update in loop transport
2018-07-22 14:25:54 +02:00
rfkill
rfkill: gpio: fix memory leak in probe error path
2018-05-16 10:06:51 +02:00
rose
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-06-24 02:58:51 -07:00
rxrpc
rxrpc: check return value of skb_to_sgvec always
2018-04-13 19:50:23 +02:00
sched
net: Prevent invalid access to skb->prev in __qdisc_drop_all
2018-12-17 21:55:09 +01:00
sctp
sctp: allocate sctp_sockaddr_entry with kzalloc
2019-01-26 09:42:51 +01:00
sunrpc
sunrpc: handle ENOMEM in rpcb_getport_async
2019-01-26 09:42:51 +01:00
switchdev
switchdev: pass pointer to fib_info instead of copy
2016-06-24 10:18:16 -07:00
tipc
tipc: fix uninit-value in tipc_nl_compat_doit
2019-01-26 09:42:51 +01:00
unix
net: drop write-only stack variable
2018-11-10 07:41:34 -08:00
vmw_vsock
VSOCK: Send reset control packet when socket is partially bound
2019-01-13 10:05:28 +01:00
wimax
net:wimax: Fix doucble word "the the" in networking.xml
2015-08-09 22:43:52 -07:00
wireless
cfg80211: reg: Init wiphy_idx in regulatory_hint_core()
2018-11-10 07:41:33 -08:00
x25
net: x25: fix one potential use-after-free issue
2018-04-13 19:50:07 +02:00
xfrm
xfrm: Fix bucket count reported to userspace
2019-01-13 10:05:31 +01:00
compat.c
sock: Make sock->sk_stamp thread-safe
2019-01-13 10:05:28 +01:00
Kconfig
Make DST_CACHE a silent config option
2018-02-25 11:03:37 +01:00
Makefile
net: Introduce L3 Master device abstraction
2015-09-29 20:40:32 -07:00
socket.c
net: socket: fix a missing-check bug
2018-11-10 07:41:41 -08:00
sysctl_net.c
net: Use ns_capable_noaudit() when determining net sysctl permissions
2016-09-15 08:27:50 +02:00