Haishuang Yan 6926655998 ip6_tunnel: fix possible use-after-free on xmit ...

[ Upstream commit 01f5bffad5 ]

ip4ip6/ip6ip6 tunnels run iptunnel_handle_offloads on xmit which
can cause a possible use-after-free accessing iph/ipv6h pointer
since the packet will be 'uncloned' running pskb_expand_head if
it is a cloned gso skb.

Fixes: 0e9a709560 ("ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets")
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-08-09 17:53:34 +02:00

..

ila

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

netfilter

netfilter: ipv6: nf_defrag: accept duplicate fragments again

2019-07-21 09:04:21 +02:00

addrconf_core.c

Ipvlan should return an error when an address is already in use.

2017-06-09 12:26:07 -04:00

addrconf.c

net: fix IPv6 prefix route residue

2019-02-23 09:06:42 +01:00

addrlabel.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

af_inet6.c

ipv6: Consider sk_bound_dev_if when binding a socket to an address

2019-02-06 17:31:31 +01:00

ah6.c

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

2017-06-23 14:17:31 -04:00

anycast.c

net, ipv6: convert ifacaddr6.aca_refcnt from atomic_t to refcount_t

2017-07-04 01:29:04 -07:00

calipso.c

ipv6: make ipv6_renew_options() interrupt/kernel safe

2018-08-24 13:09:13 +02:00

datagram.c

ip: on queued skb use skb_header_pointer instead of pskb_may_pull

2019-01-23 08:09:47 +01:00

esp6_offload.c

esp: Fix GRO when the headers not fully in the linear part of the skb.

2018-02-25 11:07:46 +01:00

esp6.c

esp: Skip TX bytes accounting when sending from a request socket

2019-03-23 14:35:14 +01:00

exthdrs_core.c

…

exthdrs_offload.c

…

exthdrs.c

ipv6: make ipv6_renew_options() interrupt/kernel safe

2018-08-24 13:09:13 +02:00

fib6_notifier.c

net: Add module reference to FIB notifiers

2017-09-01 20:33:42 -07:00

fib6_rules.c

net: ipv6: avoid overhead when no custom FIB rules are installed

2017-08-08 21:40:08 -07:00

fou6.c

fou: make local function static

2017-05-21 13:42:36 -04:00

icmp.c

net/ipv6: Fix linklocal to global address with VRF

2018-07-28 07:55:42 +02:00

inet6_connection_sock.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-01-28 10:33:06 -05:00

inet6_hashtables.c

net/tcp: Fix socket lookups with SO_BINDTODEVICE

2018-07-22 14:28:46 +02:00

ip6_checksum.c

net: udp: fix handling of CHECKSUM_COMPLETE packets

2018-11-04 14:52:49 +01:00

ip6_fib.c

ipv6: fix typo in fib6_net_exit()

2017-09-08 16:09:04 -07:00

ip6_flowlabel.c

ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero

2019-06-22 08:16:14 +02:00

ip6_gre.c

ip6_gre: better validate user provided tunnel names

2018-04-12 12:32:25 +02:00

ip6_icmp.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ip6_input.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-04-20 10:35:33 -04:00

ip6_offload.c

gso_segment: Reset skb->mac_len after modifying network header

2018-09-29 03:06:00 -07:00

ip6_offload.h

…

ip6_output.c

ipv6: Fix dangling pointer when ipv6 fragment

2019-04-17 08:37:45 +02:00

ip6_tunnel.c

ip6_tunnel: fix possible use-after-free on xmit

2019-08-09 17:53:34 +02:00

ip6_udp_tunnel.c

ipv6: explicitly initialize udp6_addr in udp_sock_create6()

2019-01-09 17:14:43 +01:00

ip6_vti.c

ipv6: tunnels: fix two use-after-free

2019-01-09 17:14:43 +01:00

ip6mr.c

ip6mr: Do not call __IP6_INC_STATS() from preemptible context

2019-03-13 14:03:07 -07:00

ipcomp6.c

net: inet: Support UID-based routing in IP protocols.

2016-11-04 14:45:23 -04:00

ipv6_sockglue.c

ipv6: make ipv6_renew_options() interrupt/kernel safe

2018-08-24 13:09:13 +02:00

Kconfig

ipv6: ila: select CONFIG_DST_CACHE

2018-07-25 11:25:09 +02:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

mcast_snoop.c

…

mcast.c

ipv6: mcast: fix a use-after-free in inet6_mc_check

2018-11-04 14:52:48 +01:00

mip6.c

ktime: Get rid of ktime_equal()

2016-12-25 17:21:23 +01:00

ndisc.c

ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called

2018-11-04 14:52:48 +01:00

netfilter.c

netfilter: ipv6: Don't preserve original oif for loopback address

2019-02-27 10:08:08 +01:00

output_core.c

inet: switch IP ID generator to siphash

2019-06-09 09:18:10 +02:00

ping.c

net: ping: do not abuse udp_poll()

2017-06-04 22:56:55 -04:00

proc.c

inet: frags: break the 2GB limit for frags storage

2018-09-19 22:43:46 +02:00

protocol.c

net: Add sysctl to toggle early demux for tcp and udp

2017-03-24 13:17:07 -07:00

raw.c

ipv6: use READ_ONCE() for inet->hdrincl as in ipv4

2019-06-11 12:21:46 +02:00

reassembly.c

net: IP6 defrag: use rbtrees for IPv6 defrag

2019-04-27 09:35:40 +02:00

route.c

net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255

2019-03-19 13:13:24 +01:00

seg6_hmac.c

ipv6: sr: fix passing wrong flags to crypto_alloc_shash()

2018-07-22 14:28:43 +02:00

seg6_iptunnel.c

ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation

2019-02-06 17:31:31 +01:00

seg6_local.c

ipv6: sr: remove duplicate routing header type check

2017-09-11 14:34:10 -07:00

seg6.c

ipv6: propagate genlmsg_reply return code

2019-02-27 10:08:06 +01:00

sit.c

vrf: sit mtu should not be updated when vrf netdev is the link

2019-05-16 19:42:34 +02:00

syncookies.c

ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()

2017-07-18 11:22:51 -07:00

sysctl_net_ipv6.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

tcp_ipv6.c

tcp: do not use ipv6 header for ipv4 flow

2019-04-03 06:25:09 +02:00

tcpv6_offload.c

gso: validate gso_type in GSO handlers

2018-01-31 14:03:47 +01:00

tunnel6.c

…

udp_impl.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

udp_offload.c

gso: validate gso_type in GSO handlers

2018-01-31 14:03:47 +01:00

udp.c

bpf: udp: ipv6: Avoid running reuseport's bpf_prog from __udp6_lib_err

2019-07-03 13:16:03 +02:00

udplite.c

udplite: call proper backlog handlers

2016-11-24 15:32:14 -05:00

xfrm6_input.c

xfrm: reset transport header back to network header after all input transforms ahave been applied

2018-11-04 14:52:37 +01:00

xfrm6_mode_beet.c

networking: make skb_pull & friends return void pointers

2017-06-16 11:48:39 -04:00

xfrm6_mode_ro.c

ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()

2017-06-02 13:57:27 -04:00

xfrm6_mode_transport.c

xfrm: reset transport header back to network header after all input transforms ahave been applied

2018-11-04 14:52:37 +01:00

xfrm6_mode_tunnel.c

xfrm: Add encapsulation header offsets while SKB is not encrypted

2017-04-14 10:07:39 +02:00

xfrm6_output.c

xfrm6: call kfree_skb when skb is toobig

2018-11-04 14:52:37 +01:00

xfrm6_policy.c

xfrm6: avoid potential infinite loop in _decode_session6()

2018-07-08 15:30:51 +02:00

xfrm6_protocol.c

xfrm: input: constify xfrm_input_afinfo

2017-02-09 10:22:17 +01:00

xfrm6_state.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

xfrm6_tunnel.c

xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module

2019-05-25 18:25:34 +02:00