Sabrina Dubroca 6399f1fae4 ipv6: avoid overflow of offset in ip6_find_1stfragopt ...

In some cases, offset can overflow and can cause an infinite loop in
ip6_find_1stfragopt(). Make it unsigned int to prevent the overflow, and
cap it at IPV6_MAXPLEN, since packets larger than that should be invalid.

This problem has been here since before the beginning of git history.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

2017-07-19 22:50:14 -07:00

..

ila

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-06-15 11:59:32 -04:00

netfilter

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

2017-06-30 06:27:09 -07:00

addrconf_core.c

…

addrconf.c

net, ipv6: convert inet6_ifaddr.refcnt from atomic_t to refcount_t

2017-07-04 01:29:04 -07:00

addrlabel.c

net, ipv6: convert ip6addrlbl_entry.refcnt from atomic_t to refcount_t

2017-07-04 01:29:04 -07:00

af_inet6.c

…

ah6.c

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

2017-06-23 14:17:31 -04:00

anycast.c

net, ipv6: convert ifacaddr6.aca_refcnt from atomic_t to refcount_t

2017-07-04 01:29:04 -07:00

calipso.c

net, calipso: convert calipso_doi.refcount from atomic_t to refcount_t

2017-07-04 22:35:16 +01:00

datagram.c

net: convert sock.sk_refcnt from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

esp6_offload.c

esp6_offload: Fix IP6CB(skb)->nhoff for ESP GRO

2017-06-22 10:49:14 +02:00

esp6.c

net: convert sock.sk_wmem_alloc from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

exthdrs_core.c

…

exthdrs_offload.c

…

exthdrs.c

net, ipv6: convert ipv6_txoptions.refcnt from atomic_t to refcount_t

2017-07-04 01:29:03 -07:00

fib6_rules.c

ipv6: Do not leak throw route references

2017-06-20 15:34:02 -04:00

fou6.c

…

icmp.c

net: don't global ICMP rate limit packets originating from loopback

2017-06-14 15:33:58 -04:00

inet6_connection_sock.c

…

inet6_hashtables.c

net: convert sock.sk_refcnt from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

ip6_checksum.c

…

ip6_fib.c

net: ipv6: Compare lwstate in detecting duplicate nexthops

2017-07-06 10:48:01 +01:00

ip6_flowlabel.c

…

ip6_gre.c

net: add netlink_ext_ack argument to rtnl_link_ops.validate

2017-06-26 23:13:22 -04:00

ip6_icmp.c

…

ip6_input.c

…

ip6_offload.c

…

ip6_offload.h

…

ip6_output.c

net: convert sock.sk_wmem_alloc from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

ip6_tunnel.c

net: add netlink_ext_ack argument to rtnl_link_ops.validate

2017-06-26 23:13:22 -04:00

ip6_udp_tunnel.c

…

ip6_vti.c

net: add netlink_ext_ack argument to rtnl_link_ops.validate

2017-06-26 23:13:22 -04:00

ip6mr.c

ip6mr: add netlink notifications on mrt6msg cache reports

2017-06-21 11:22:53 -04:00

ipcomp6.c

…

ipv6_sockglue.c

Merge branch 'work.memdup_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-05 16:05:24 -07:00

Kconfig

…

Makefile

…

mcast_snoop.c

…

mcast.c

net, ipv6: convert ifmcaddr6.mca_refcnt from atomic_t to refcount_t

2017-07-04 01:29:04 -07:00

mip6.c

…

ndisc.c

networking: make skb_put & friends return void pointers

2017-06-16 11:48:39 -04:00

netfilter.c

…

output_core.c

ipv6: avoid overflow of offset in ip6_find_1stfragopt

2017-07-19 22:50:14 -07:00

ping.c

…

proc.c

…

protocol.c

…

raw.c

…

reassembly.c

…

route.c

net: ipv6: Compare lwstate in detecting duplicate nexthops

2017-07-06 10:48:01 +01:00

seg6_hmac.c

…

seg6_iptunnel.c

…

seg6.c

…

sit.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-06-30 12:43:08 -04:00

syncookies.c

ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()

2017-07-18 11:22:51 -07:00

sysctl_net_ipv6.c

…

tcp_ipv6.c

net: convert sock.sk_refcnt from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

tcpv6_offload.c

…

tunnel6.c

…

udp_impl.h

…

udp_offload.c

…

udp.c

net: convert sock.sk_refcnt from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

udplite.c

…

xfrm6_input.c

xfrm6: Fix IPv6 payload_len in xfrm6_transport_finish

2017-06-22 10:49:14 +02:00

xfrm6_mode_beet.c

networking: make skb_pull & friends return void pointers

2017-06-16 11:48:39 -04:00

xfrm6_mode_ro.c

…

xfrm6_mode_transport.c

…

xfrm6_mode_tunnel.c

…

xfrm6_output.c

…

xfrm6_policy.c

…

xfrm6_protocol.c

…

xfrm6_state.c

…

xfrm6_tunnel.c

net, ipv6: convert xfrm6_tunnel_spi.refcnt from atomic_t to refcount_t

2017-07-04 01:29:04 -07:00