Sabrina Dubroca fcd91dd449 net: add recursion limit to GRO ... Currently, GRO can do unlimited recursion through the gro_receive handlers. This was fixed for tunneling protocols by limiting tunnel GRO to one level with encap_mark, but both VLAN and TEB still have this problem. Thus, the kernel is vulnerable to a stack overflow, if we receive a packet composed entirely of VLAN headers. This patch adds a recursion counter to the GRO layer to prevent stack overflow. When a gro_receive function hits the recursion limit, GRO is aborted for this skb and it is processed normally. This recursion counter is put in the GRO CB, but could be turned into a percpu counter if we run out of space in the CB. Thanks to Vladimír Beneš <vbenes@redhat.com> for the initial bug report. Fixes: CVE-2016-7039 Fixes: 9b174d88c2 ("net: Add Transparent Ethernet Bridging GRO support.") Fixes: 66e5133f19 ("vlan: Add GRO support for non hardware accelerated vlan") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Jiri Benc <jbenc@redhat.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Acked-by: Tom Herbert <tom@herbertland.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-10-20 14:32:22 -04:00
..
acpi	Merge branch 'smp-hotplug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2016-10-03 19:43:08 -07:00
asm-generic	Merge branch 'work.uaccess2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2016-10-11 23:38:39 -07:00
clocksource
crypto	Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2016-10-10 11:19:47 +08:00
drm	drm/crtc: constify drm_crtc_index parameter	2016-10-10 17:28:58 +02:00
dt-bindings	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux	2016-10-12 11:05:23 -07:00
keys
kvm
linux	net: add recursion limit to GRO	2016-10-20 14:32:22 -04:00
math-emu
media	Linux 4.8	2016-10-05 16:43:53 -03:00
memory
misc
net	This is relatively small, mostly to get the SG/crypto	2016-10-18 10:26:15 -04:00
pcmcia
ras
rdma	Merge of primary rdma-core code for 4.9	2016-10-09 17:04:33 -07:00
rxrpc
scsi
soc	The core clk framework changes are small again. They're mostly minor fixes	2016-10-04 11:04:57 -07:00
sound
target
trace	mm, compaction: rename COMPACT_PARTIAL to COMPACT_SUCCESS	2016-10-07 18:46:27 -07:00
uapi	rtnetlink: Add rtnexthop offload flag to compare mask	2016-10-19 11:07:57 -04:00
video	fbdev changes for 4.9	2016-10-12 11:01:37 -07:00
xen	xen: features and fixes for 4.9-rc0	2016-10-06 11:19:10 -07:00
Kbuild