leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
ab6b529475
linux/net
History
Hannes Frederic Sowa 89bc7848a9 ipv6: protect mtu calculation of wrap-around and infinite loop by rounding issues 
Raw sockets with hdrincl enabled can insert ipv6 extension headers
right into the data stream. In case we need to fragment those packets,
we reparse the options header to find the place where we can insert
the fragment header. If the extension headers exceed the link's MTU we
actually cannot make progress in such a case.

Instead of ending up in broken arithmetic or rounding towards 0 and
entering an endless loop in ip6_fragment, just prevent those cases by
aborting early and signal -EMSGSIZE to user space.

This is the second version of the patch which doesn't use the
overflow_usub function, which got reverted for now.

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-29 07:01:50 -07:00
..
6lowpan 6lowpan: move module_init into core functionality 2015-08-11 22:05:36 +02:00
9p net/9p: Remove ib_get_dma_mr calls 2015-08-30 18:12:36 -04:00
802
8021q net: 8021q: convert to using IFF_NO_QUEUE 2015-08-18 11:55:06 -07:00
appletalk
atm atm: deal with setting entry before mkip was called 2015-09-17 22:13:32 -07:00
ax25 NET: AX.25: Stop heartbeat timer on disconnect. 2015-07-15 15:59:58 -07:00
batman-adv batman-adv: turn batadv_neigh_node_get() into local function 2015-08-27 20:15:34 +02:00
bluetooth Bluetooth: Fix initializing conn_params in scan phase 2015-10-16 09:24:41 +02:00
bridge bridge: fix igmpv3 / mldv2 report parsing 2015-09-11 15:08:20 -07:00
caif net: caif: convert to using IFF_NO_QUEUE 2015-08-18 11:55:07 -07:00
can can: replace timestamp as unique skb attribute 2015-07-12 21:13:22 +02:00
ceph rbd: use writefull op for object size writes 2015-10-16 16:49:01 +02:00
core openvswitch: Fix egress tunnel info. 2015-10-22 19:39:25 -07:00
dcb
dccp tcp/dccp: fix timewait races in timer handling 2015-09-21 16:32:29 -07:00
decnet net: ipv6: use common fib_default_rule_pref 2015-09-09 14:19:50 -07:00
dns_resolver
dsa net: dsa: exit probe if no switch were found 2015-10-07 04:56:11 -07:00
ethernet flow_dissector: Add flags argument to skb_flow_dissector functions 2015-09-01 15:06:22 -07:00
hsr net: hsr: convert to using IFF_NO_QUEUE 2015-08-18 11:55:07 -07:00
ieee802154 Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next 2015-08-29 13:15:03 -07:00
ipv4 fib_trie: leaf_walk_rcu should not compute key if key is less than pn->key 2015-10-27 18:14:51 -07:00
ipv6 ipv6: protect mtu calculation of wrap-around and infinite loop by rounding issues 2015-10-29 07:01:50 -07:00
ipx
irda irda: precedence bug in irlmp_seq_hb_idx() 2015-10-21 07:48:26 -07:00
iucv
key af_key: fix two typos 2015-10-23 03:05:19 -07:00
l2tp l2tp: protect tunnel->del_work by ref_count 2015-09-28 22:39:10 -07:00
lapb
llc tcp: fix recv with flags MSG_WAITALL | MSG_PEEK 2015-07-27 01:06:53 -07:00
mac80211 mac80211: Fix hwflags debugfs file format 2015-10-13 10:30:56 +02:00
mac802154 ieee802154: add ack request default handling 2015-08-10 20:43:06 +02:00
mpls mpls: fix mpls_net_init memory leak 2015-08-31 12:45:09 -07:00
netfilter netfilter: ipset: Fix sleeping memory allocation in atomic context 2015-10-17 13:01:24 +02:00
netlabel
netlink netlink: fix locking around NETLINK_LIST_MEMBERSHIPS 2015-10-22 07:18:28 -07:00
netrom
nfc nfc: netlink: Add capability to reply to vendor_cmd with data 2015-08-20 22:00:11 +02:00
openvswitch openvswitch: Fix skb leak using IPv6 defrag 2015-10-27 19:32:18 -07:00
packet Fix AF_PACKET ABI breakage in 4.2 2015-09-23 14:33:55 -07:00
phonet
rds RDS-TCP: Recover correctly from pskb_pull()/pksb_trim() failure in rds_tcp_data_recv 2015-10-27 19:46:34 -07:00
rfkill rfkill: Copy "all" global state to other types 2015-09-04 14:26:56 +02:00
rose Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-06-24 02:58:51 -07:00
rxrpc
sched sch_hhf: fix return value of hhf_drop() 2015-10-11 04:49:33 -07:00
sctp net: sctp: Don't use 64 kilobyte lookup table for four elements 2015-09-28 22:52:21 -07:00
sunrpc Changes for 4.3-rc5 2015-10-15 13:44:35 -07:00
switchdev switchdev: check if the vlan id is in the proper vlan range 2015-10-13 04:43:24 -07:00
tipc tipc: conditionally expand buffer headroom over udp tunnel 2015-10-21 19:13:48 -07:00
unix net/unix: fix logic about sk_peek_offset 2015-10-05 06:33:09 -07:00
vmw_vsock VSOCK: Fix lockdep issue. 2015-10-22 18:26:29 -07:00
wimax net:wimax: Fix doucble word "the the" in networking.xml 2015-08-09 22:43:52 -07:00
wireless cfg80211: regulatory: restore proper user alpha2 2015-09-04 14:29:25 +02:00
x25
xfrm xfrm: Fix state threshold configuration from userspace 2015-09-29 11:45:55 +02:00
compat.c
Kconfig lwtunnel: infrastructure for handling light weight tunnels like mpls 2015-07-21 10:39:03 -07:00
Makefile
socket.c
sysctl_net.c net: sysctl: fix a kmemleak warning 2015-10-23 06:22:08 -07:00