Jason Wang 666a76c79f net: flow_dissector: fail on evil iph->ihl ...

[ Upstream commit 6f09234385 ]

We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
is evil (less than 5).

This issue were introduced by commit ec5efe7946
(rps: support IPIP encapsulation).

Signed-off-by: Jason Wang <jasowang@redhat.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2013-11-20 12:27:46 -08:00

..

9p

9p: fix off by one causing access violations and memory corruption

2013-07-28 16:29:58 -07:00

802

net/802/mrp: fix lockdep splat

2013-05-14 13:02:30 -07:00

8021q

net: vlan: fix nlmsg size calculation in vlan_get_size()

2013-11-04 04:31:02 -08:00

appletalk

appletalk: info leak in ->getname()

2013-04-25 01:47:58 -04:00

atm

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-05-01 17:51:54 -07:00

ax25

ax25: fix info leak via msg_name in ax25_recvmsg()

2013-04-07 16:28:00 -04:00

batman-adv

batman-adv: Don't handle address updates when bla is disabled

2013-06-10 08:42:18 +02:00

bluetooth

Bluetooth: Fix rfkill functionality during the HCI setup stage

2013-10-13 16:08:32 -07:00

bridge

bridge: Correctly clamp MAX forward_delay when enabling STP

2013-11-04 04:31:03 -08:00

caif

caif: Add missing braces to multiline if in cfctrl_linkup_request

2013-10-13 16:08:28 -07:00

can

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-05-01 17:51:54 -07:00

ceph

libceph: use pg_num_mask instead of pgp_num_mask for pg.seed calc

2013-09-26 17:18:29 -07:00

core

net: flow_dissector: fail on evil iph->ihl

2013-11-20 12:27:46 -08:00

dcb

rtnetlink: Remove passing of attributes into rtnl_doit functions

2013-03-22 10:31:16 -04:00

dccp

net:dccp: do not report ICMP redirects to user space

2013-10-13 16:08:30 -07:00

decnet

decnet: remove duplicated include from dn_table.c

2013-04-07 17:12:01 -04:00

dns_resolver

…

dsa

dsa: fix freeing of sparse port allocation

2013-03-25 12:23:41 -04:00

ethernet

net: add ETH_P_802_3_MIN

2013-03-28 01:20:42 -04:00

ieee802154

ieee802154/nl-mac.c: make some MLME operations optional

2013-04-08 12:00:16 -04:00

ipv4

ip_gre: Fix WCCPv2 header parsing.

2013-11-20 12:27:46 -08:00

ipv6

ipv6: ip6_dst_check needs to check for expired dst_entries

2013-11-20 12:27:46 -08:00

ipx

…

irda

net: irda: using kzalloc() instead of kmalloc() to avoid strncpy() issue.

2013-05-19 15:10:47 -07:00

iucv

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-04-22 20:32:51 -04:00

key

af_key: more info leaks in pfkey messages

2013-08-11 18:35:25 -07:00

l2tp

l2tp: must disable bh before calling l2tp_xmit_skb()

2013-11-04 04:31:02 -08:00

lapb

…

llc

llc: Fix missing msg_namelen update in llc_ui_recvmsg()

2013-04-07 16:28:01 -04:00

mac80211

mac80211: fix crash if bitrate calculation goes wrong

2013-11-13 12:05:30 +09:00

mac802154

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-04-30 03:55:20 -04:00

netfilter

netfilter: nf_conntrack: fix rt6i_gateway checks for H.323 helper

2013-11-04 04:31:05 -08:00

netlabel

netlabel: improve domain mapping validation

2013-05-19 14:49:55 -07:00

netlink

genl: Hold reference on correct module while netlink-dump.

2013-09-14 06:54:55 -07:00

netrom

netrom: info leak in ->getname()

2013-04-25 01:47:58 -04:00

nfc

NFC: llcp: Fix non blocking sockets connections

2013-08-29 09:47:30 -07:00

openvswitch

openvswitch: Remove unneeded ovs_netdev_get_ifindex()

2013-04-30 00:19:11 -04:00

packet

packet: restore packet statistics tp_packets to include drops

2013-09-14 06:54:55 -07:00

phonet

rtnetlink: Remove passing of attributes into rtnl_doit functions

2013-03-22 10:31:16 -04:00

rds

net/rds: zero last byte for strncpy

2013-03-08 00:35:44 -05:00

rfkill

Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

2013-04-22 14:58:14 -04:00

rose

rose: fix info leak via msg_name in rose_recvmsg()

2013-04-07 16:28:02 -04:00

rxrpc

…

sched

net_sched: htb: fix a typo in htb_change_class()

2013-10-13 16:08:29 -07:00

sctp

sctp: Perform software checksum if packet has to be fragmented.

2013-11-04 04:31:04 -08:00

sunrpc

rpc: let xdr layer allocate gssproxy receieve pages

2013-10-01 09:17:48 -07:00

tipc

tipc: set sk_err correctly when connection fails

2013-09-14 06:54:56 -07:00

unix

net: unix: inherit SOCK_PASS{CRED, SEC} flags from socket to fix race

2013-11-04 04:31:04 -08:00

vmw_vsock

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-04-30 03:55:20 -04:00

wimax

…

wireless

cfg80211: fix warning when using WEXT for IBSS

2013-11-13 12:05:31 +09:00

x25

x25: Fix broken locking in ioctl error paths.

2013-07-28 16:29:45 -07:00

xfrm

xfrm: force a garbage collection after deleting a policy

2013-05-31 17:30:07 -07:00

compat.c

net: heap overflow in __audit_sockaddr()

2013-11-04 04:31:00 -08:00

Kconfig

netlink: kconfig: move mmap i/o into netlink kconfig

2013-05-01 15:02:42 -04:00

Makefile

…

nonet.c

…

socket.c

net: heap overflow in __audit_sockaddr()

2013-11-04 04:31:00 -08:00

sysctl_net.c

net: Update the sysctl permissions handler to test effective uid/gid

2013-10-13 16:08:34 -07:00