iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/ipv6
History
Steffen Klassert fee4dfbda6 esp: Fix possible buffer overflow in ESP transformation 
commit ebe48d368e97d007bfeb76fcb065d6cfc4c96645 upstream.

The maximum message size that can be send is bigger than
the  maximum site that skb_page_frag_refill can allocate.
So it is possible to write beyond the allocated buffer.

Fix this by doing a fallback to COW in that case.

v2:

Avoid get get_order() costs as suggested by Linus Torvalds.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Reported-by: valis <sec@valis.email>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-03-28 08:46:44 +02:00
..
ila
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
netfilter
netfilter: ip6_tables: zero-initialize fragment offset
2021-10-17 10:42:33 +02:00
addrconf_core.c
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
2019-12-18 16:08:42 +01:00
addrconf.c
ipv6: prevent a possible race condition with lifetimes
2022-03-16 13:21:47 +01:00
addrlabel.c
ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init
2020-12-08 10:40:23 +01:00
af_inet6.c
net: ipv6: add fib6_nh_release_dsts stub
2021-12-01 09:23:33 +01:00
ah6.c
ah6: fix error return code in ah6_input()
2020-11-24 13:28:55 +01:00
anycast.c
ipv6: fix memory leaks on IPV6_ADDRFORM path
2020-08-11 15:33:39 +02:00
calipso.c
cipso,calipso: resolve a number of problems with the DOI refcounts
2021-03-17 17:03:35 +01:00
datagram.c
net: ipv6: add net argument to ip6_dst_lookup_flow
2019-12-18 16:08:40 +01:00
esp6_offload.c
esp: delete NETIF_F_SCTP_CRC bit from features for esp offload
2021-04-14 08:24:13 +02:00
esp6.c
esp: Fix possible buffer overflow in ESP transformation
2022-03-28 08:46:44 +02:00
exthdrs_core.c
ipv6: remove printk
2019-07-27 14:23:48 -07:00
exthdrs_offload.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
exthdrs.c
ipv6: fix out-of-bound access in ip6_parse_tlv()
2021-07-14 16:53:33 +02:00
fib6_notifier.c
…
fib6_rules.c
ipv6: fix memory leak in fib6_rule_suppress
2021-12-08 09:01:13 +01:00
fou6.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
icmp.c
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-03-04 10:26:53 +01:00
inet6_connection_sock.c
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:18:58 +01:00
inet6_hashtables.c
net: prefer socket bound to interface when not in VRF
2021-10-13 10:08:20 +02:00
ip6_checksum.c
…
ip6_fib.c
ipv6: annotate accesses to fn->fn_sernum
2022-02-01 17:24:38 +01:00
ip6_flowlabel.c
ipv6: fix static key imbalance in fl_create()
2019-07-11 14:43:25 -07:00
ip6_gre.c
xfrm: fix policy lookup for ipv6 gre packets
2022-01-27 09:19:50 +01:00
ip6_icmp.c
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-03-04 10:26:53 +01:00
ip6_input.c
ipv6: weaken the v4mapped source check
2021-04-07 14:47:38 +02:00
ip6_offload.c
gso: do not skip outer ip header in case of ipip and net_failover
2022-03-02 11:41:06 +01:00
ip6_offload.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
ip6_output.c
net: ipv6: fix skb_over_panic in __ip6_append_data
2022-03-28 08:46:44 +02:00
ip6_tunnel.c
ipv6_tunnel: Rate limit warning messages
2022-02-01 17:24:36 +01:00
ip6_udp_tunnel.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
ip6_vti.c
ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
2022-01-11 15:23:33 +01:00
ip6mr.c
ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
2022-02-16 12:52:51 +01:00
ipcomp6.c
xfrm: remove type and offload_type map from xfrm_state_afinfo
2019-06-06 08:34:50 +02:00
ipv6_sockglue.c
ipv6: fix memory leaks on IPV6_ADDRFORM path
2020-08-11 15:33:39 +02:00
Kconfig
net: ipv6: fix kconfig dependency warning for IPV6_SEG6_HMAC
2020-09-26 18:03:13 +02:00
Makefile
…
mcast_snoop.c
net: bridge: mcast: fix broken length + header check for MRDv6 Adv.
2021-05-14 09:44:32 +02:00
mcast.c
mld: fix panic in mld_newpack()
2021-06-03 08:59:14 +02:00
mip6.c
xfrm: remove type and offload_type map from xfrm_state_afinfo
2019-06-06 08:34:50 +02:00
ndisc.c
Exempt multicast addresses from five-second neighbor lifetime
2020-11-24 13:28:56 +01:00
netfilter.c
netfilter: use actual socket sk rather than skb sk when routing harder
2020-11-18 19:20:17 +01:00
output_core.c
ipv6: use prandom_u32() for ID generation
2021-07-19 08:53:09 +02:00
ping.c
ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'
2019-09-12 11:20:33 +01:00
proc.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2019-06-07 11:00:14 -07:00
protocol.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
raw.c
net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind()
2021-04-14 08:24:12 +02:00
reassembly.c
ipv6: record frag_max_size in atomic fragments in input path
2021-06-03 08:59:15 +02:00
route.c
ipv6: annotate accesses to fn->fn_sernum
2022-02-01 17:24:38 +01:00
seg6_hmac.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
seg6_iptunnel.c
seg6: fix the iif in the IPv6 socket control block
2021-12-14 14:49:00 +01:00
seg6_local.c
ipv6: sr: remove SKB_GSO_IPXIP6 on End.D* actions
2020-01-29 16:45:20 +01:00
seg6.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
sit.c
sit: do not call ipip6_dev_free() from sit_init_net()
2021-12-22 09:29:38 +01:00
syncookies.c
net: Update window_clamp if SOCK_RCVBUF is set
2020-11-18 19:20:32 +01:00
sysctl_net_ipv6.c
ipv6: Fix sysctl max for fib_multipath_hash_policy
2020-09-12 14:18:55 +02:00
tcp_ipv6.c
ipv6: tcp: drop silly ICMPv6 packet too big messages
2021-07-25 14:35:15 +02:00
tcpv6_offload.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tunnel6.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
udp_impl.h
…
udp_offload.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
udp.c
udp: using datalen to cap ipv6 udp max gso segments
2022-01-05 12:37:44 +01:00
udplite.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
xfrm6_input.c
…
xfrm6_output.c
net: ipv6: fix return value of ip6_skb_dst_mtu
2021-07-25 14:35:14 +02:00
xfrm6_policy.c
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:18:58 +01:00
xfrm6_protocol.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
xfrm6_state.c
xfrm: remove eth_proto value from xfrm_state_afinfo
2019-06-06 08:34:50 +02:00
xfrm6_tunnel.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00