Eric Dumazet 64199fc0a4 ipv4: fix use-after-free in ip_cmsg_recv_dstaddr() ...

Caching ip_hdr(skb) before a call to pskb_may_pull() is buggy,
do not do it.

Fixes: 2efd4fca703a ("ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2018-10-02 22:32:05 -07:00

..

bpfilter

bpfilter: remove trailing newline

2018-07-24 14:10:42 -07:00

netfilter

netfilter: kconfig: nat related expression depend on nftables core

2018-08-31 19:07:10 +02:00

af_inet.c

gso_segment: Reset skb->mac_len after modifying network header

2018-09-13 12:09:32 -07:00

ah4.c

net: use -ENOSPC for transient busy indication

2017-11-03 22:11:17 +08:00

arp.c

proc: introduce proc_create_net{,_data}

2018-05-16 07:24:30 +02:00

cipso_ipv4.c

tcp/dccp: fix ireq->opt races

2017-10-21 01:33:19 +01:00

datagram.c

net: Set sk_txhash from a random number

2015-07-29 22:44:04 -07:00

devinet.c

route: add support for directed broadcast forwarding

2018-07-29 12:37:06 -07:00

esp4_offload.c

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

2018-07-27 09:33:37 -07:00

esp4.c

esp4: remove redundant initialization of pointer esph

2018-02-13 13:59:03 +01:00

fib_frontend.c

ipv4: remove BUG_ON() from fib_compute_spec_dst

2018-07-28 19:06:12 -07:00

fib_lookup.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

fib_notifier.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

fib_rules.c

net: fib_rules: add extack support

2018-04-23 10:21:24 -04:00

fib_semantics.c

net: metrics: add proper netlink validation

2018-06-05 12:29:43 -04:00

fib_trie.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2018-06-06 18:39:49 -07:00

fou.c

Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net

2018-07-03 10:29:26 +09:00

gre_demux.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2016-06-30 05:03:36 -04:00

gre_offload.c

Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net

2018-07-03 10:29:26 +09:00

icmp.c

ipv4: ipcm_cookie initializers

2018-07-07 10:58:49 +09:00

igmp.c

igmp: fix incorrect unsolicit report count after link down and up

2018-09-02 13:39:37 -07:00

inet_connection_sock.c

inet: make sure to grab rcu_read_lock before using ireq->ireq_opt

2018-10-02 15:52:12 -07:00

inet_diag.c

sock_diag: request _diag module only when the family or proto has been registered

2018-03-12 11:03:42 -04:00

inet_fragment.c

ip: process in-order fragments efficiently

2018-08-11 17:54:18 -07:00

inet_hashtables.c

bpf: Enable BPF_PROG_TYPE_SK_REUSEPORT bpf prog in reuseport selection

2018-08-11 01:58:46 +02:00

inet_timewait_sock.c

soreuseport: initialise timewait reuseport field

2018-04-07 22:32:32 -04:00

inetpeer.c

inetpeer: fix uninit-value in inet_getpeer

2018-04-09 10:57:35 -04:00

ip_forward.c

net: ipv4: Control SKB reprioritization after forwarding

2018-08-01 09:52:30 -07:00

ip_fragment.c

ip: frags: fix crash in ip_do_fragment()

2018-09-09 14:50:56 -07:00

ip_gre.c

erspan: fix error handling for erspan tunnel

2018-09-11 23:50:54 -07:00

ip_input.c

net: ipv4: fix listify ip_rcv_finish in case of forwarding

2018-07-12 16:40:19 -07:00

ip_options.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ip_output.c

Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net

2018-07-24 19:21:58 -07:00

ip_sockglue.c

ipv4: fix use-after-free in ip_cmsg_recv_dstaddr()

2018-10-02 22:32:05 -07:00

ip_tunnel_core.c

net/ipv4: Update ip_tunnel_metadata_cnt static key to modern api

2018-05-10 15:13:33 -04:00

ip_tunnel.c

ip_tunnel: be careful when accessing the inner header

2018-09-24 12:27:04 -07:00

ip_vti.c

ip_vti: fix a null pointer deferrence when create vti fallback tunnel

2018-08-19 11:26:39 -07:00

ipcomp.c

ipv4: coding style: comparison for equality with NULL

2015-04-03 12:11:15 -04:00

ipconfig.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2018-06-06 18:39:49 -07:00

ipip.c

net: Drop pernet_operations::async

2018-03-27 13:18:09 -04:00

ipmr_base.c

rhashtable: split rhashtable.h

2018-06-22 13:43:27 +09:00

ipmr.c

net: ipmr: add support for passing full packet on wrong vif

2018-07-13 14:21:16 -07:00

Kconfig

net: remove blank lines at end of file

2018-07-24 14:10:43 -07:00

Makefile

net: remove blank lines at end of file

2018-07-24 14:10:43 -07:00

metrics.c

net: metrics: add proper netlink validation

2018-06-05 12:29:43 -04:00

netfilter.c

netfilter: utils: move nf_ip_checksum* from ipv4 to utils

2018-07-16 17:51:48 +02:00

netlink.c

ipv4: support sport, dport and ip_proto in RTM_GETROUTE

2018-05-23 15:14:12 -04:00

ping.c

net: add helpers checking if socket can be bound to nonlocal address

2018-08-01 09:50:04 -07:00

proc.c

ip: discard IPv4 datagrams with overlapping segments.

2018-08-05 17:16:46 -07:00

protocol.c

net: Add sysctl to toggle early demux for tcp and udp

2017-03-24 13:17:07 -07:00

raw_diag.c

net: ipv6: add second dif to raw socket lookups

2017-08-07 11:39:22 -07:00

raw.c

ip: remove tx_flags from ipcm_cookie and use same logic for v4 and v6

2018-07-07 10:58:49 +09:00

route.c

route: add support for directed broadcast forwarding

2018-07-29 12:37:06 -07:00

syncookies.c

net/ipv4: disable SMC TCP option with SYN Cookies

2018-03-25 20:53:54 -04:00

sysctl_net_ipv4.c

net-tcp: /proc/sys/net/ipv4/tcp_probe_interval is a u32 not int

2018-09-26 20:33:21 -07:00

tcp_bbr.c

tcp_bbr: apply PROBE_RTT cwnd cap even if acked==0

2018-08-22 21:45:32 -07:00

tcp_bic.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_cdg.c

tcp: cdg: make struct tcp_cdg static

2017-10-16 21:24:25 +01:00

tcp_cong.c

tcp: Namespace-ify sysctl_tcp_default_congestion_control

2017-11-15 14:09:52 +09:00

tcp_cubic.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_dctcp.c

tcp: avoid resetting ACK timer in DCTCP

2018-08-11 11:31:35 -07:00

tcp_diag.c

net: sock: replace sk_state_load with inet_sk_state_load and remove sk_state_store

2017-12-20 14:00:25 -05:00

tcp_fastopen.c

tcp: pause Fast Open globally after third consecutive timeout

2017-12-13 15:51:12 -05:00

tcp_highspeed.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_htcp.c

tcp: fix cwnd undo in Reno and HTCP congestion controls

2017-08-06 21:25:10 -07:00

tcp_hybla.c

tcp: make undo_cwnd mandatory for congestion modules

2016-11-21 13:20:17 -05:00

tcp_illinois.c

net/tcp/illinois: replace broken algorithm reference link

2018-02-28 12:03:47 -05:00

tcp_input.c

tcp/dccp: fix lockdep issue when SYN is backlogged

2018-10-01 15:42:13 -07:00

tcp_ipv4.c

inet: make sure to grab rcu_read_lock before using ireq->ireq_opt

2018-10-02 15:52:12 -07:00

tcp_lp.c

tcp: switch TCP TS option (RFC 7323) to 1ms clock

2017-05-17 16:06:01 -04:00

tcp_metrics.c

net: Drop pernet_operations::async

2018-03-27 13:18:09 -04:00

tcp_minisocks.c

tcp: do not restart timewait timer on rst reception

2018-08-31 23:10:35 -07:00

tcp_nv.c

tcp_nv: fix potential integer overflow in tcpnv_acked

2018-01-31 10:26:30 -05:00

tcp_offload.c

tcp: Don't coalesce decrypted and encrypted SKBs

2018-07-16 00:12:09 -07:00

tcp_output.c

tcp: remove set but not used variable 'skb_size'

2018-08-01 09:57:09 -07:00

tcp_rate.c

tcp: expose both send and receive intervals for rate sample

2018-07-11 23:01:56 -07:00

tcp_recovery.c

tcp: add stat of data packet reordering events

2018-08-01 09:56:10 -07:00

tcp_scalable.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_timer.c

tcp: make function tcp_retransmit_stamp() static

2018-07-25 16:35:45 -07:00

tcp_ulp.c

tcp, ulp: fix leftover icsk_ulp_ops preventing sock from reattach

2018-08-16 14:58:08 -07:00

tcp_vegas.c

tcp: fix under-evaluated ssthresh in TCP Vegas

2017-09-29 06:07:00 +01:00

tcp_vegas.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

tcp_veno.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_westwood.c

tcp: Revert "tcp: remove CA_ACK_SLOWPATH"

2017-08-30 11:20:08 -07:00

tcp_yeah.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp.c

tcp: really ignore MSG_ZEROCOPY if no SO_ZEROCOPY

2018-09-07 23:11:06 -07:00

tunnel4.c

inet: whitespace cleanup

2018-02-28 11:43:28 -05:00

udp_diag.c

udp: fix rx queue len reported by diag and proc interface

2018-06-08 19:55:15 -04:00

udp_impl.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

udp_offload.c

Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net

2018-07-03 10:29:26 +09:00

udp_tunnel.c

net: add infrastructure to un-offload UDP tunnel port

2017-07-24 13:52:59 -07:00

udp.c

udp4: fix IP_CMSG_CHECKSUM for connected sockets

2018-09-16 15:27:44 -07:00

udplite.c

proc: introduce proc_create_net{,_data}

2018-05-16 07:24:30 +02:00

xfrm4_input.c

xfrm: reset transport header back to network header after all input transforms ahave been applied

2018-09-04 10:26:30 +02:00

xfrm4_mode_beet.c

networking: make skb_pull & friends return void pointers

2017-06-16 11:48:39 -04:00

xfrm4_mode_transport.c

xfrm: reset transport header back to network header after all input transforms ahave been applied

2018-09-04 10:26:30 +02:00

xfrm4_mode_tunnel.c

xfrm: Verify MAC header exists before overwriting eth_hdr(skb)->h_proto

2018-03-07 10:54:29 +01:00

xfrm4_output.c

net: xfrm: use skb_gso_validate_network_len() to check gso sizes

2018-03-04 17:49:17 -05:00

xfrm4_policy.c

net: Drop pernet_operations::async

2018-03-27 13:18:09 -04:00

xfrm4_protocol.c

xfrm: input: constify xfrm_input_afinfo

2017-02-09 10:22:17 +01:00

xfrm4_state.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

xfrm4_tunnel.c

sit: add IPv4 over IPv4 support

2013-05-31 17:19:05 -07:00