Eric Dumazet 232cd35d08 ipv6: fix out of bound writes in __ip6_append_data() ... Andrey Konovalov and idaifish@gmail.com reported crashes caused by one skb shared_info being overwritten from __ip6_append_data() Andrey program lead to following state : copy -4200 datalen 2000 fraglen 2040 maxfraglen 2040 alloclen 2048 transhdrlen 0 offset 0 fraggap 6200 The skb_copy_and_csum_bits(skb_prev, maxfraglen, data + transhdrlen, fraggap, 0); is overwriting skb->head and skb_shared_info Since we apparently detect this rare condition too late, move the code earlier to even avoid allocating skb and risking crashes. Once again, many thanks to Andrey and syzkaller team. Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Reported-by: <idaifish@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-05-22 11:47:44 -04:00
..
ila	net/ipv6/ila/ila_xlat.c: simplify a strange allocation pattern	2017-05-08 17:15:12 -07:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2017-05-03 10:11:26 -04:00
Kconfig	ipv6: sr: select DST_CACHE by default	2017-03-27 16:05:06 -07:00
Makefile	…
addrconf.c	ipv6: avoid dad-failures for addresses with NODAD	2017-05-15 14:31:51 -04:00
addrconf_core.c	…
addrlabel.c	net: rtnetlink: plumb extended ack to doit function	2017-04-17 15:35:38 -04:00
af_inet6.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-04-26 22:39:08 -04:00
ah6.c	…
anycast.c	…
calipso.c	…
datagram.c	net-timestamp: avoid use-after-free in ip_recv_error	2017-04-17 12:59:22 -04:00
esp6.c	esp: Fix misplaced spin_unlock_bh.	2017-04-24 07:56:31 +02:00
esp6_offload.c	esp4/6: Fix GSO path for non-GSO SW-crypto packets	2017-04-19 07:48:57 +02:00
exthdrs.c	ipv6: Need to export ipv6_push_frag_opts for tunneling now.	2017-05-01 15:10:20 -04:00
exthdrs_core.c	…
exthdrs_offload.c	…
fib6_rules.c	…
fou6.c	…
icmp.c	…
inet6_connection_sock.c	…
inet6_hashtables.c	…
ip6_checksum.c	…
ip6_fib.c	ipv6: make ECMP route replacement less greedy	2017-03-13 12:16:17 -07:00
ip6_flowlabel.c	…
ip6_gre.c	ip6_tunnel: Allow policy-based routing through tunnels	2017-04-21 13:21:30 -04:00
ip6_icmp.c	…
ip6_input.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-04-20 10:35:33 -04:00
ip6_offload.c	ipv6: Check ip6_find_1stfragopt() return value properly.	2017-05-17 22:54:11 -04:00
ip6_offload.h	…
ip6_output.c	ipv6: fix out of bound writes in __ip6_append_data()	2017-05-22 11:47:44 -04:00
ip6_tunnel.c	ip6_tunnel: Fix missing tunnel encapsulation limit option	2017-05-01 14:52:45 -04:00
ip6_udp_tunnel.c	…
ip6_vti.c	ip6_tunnel: Allow policy-based routing through tunnels	2017-04-21 13:21:30 -04:00
ip6mr.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-04-21 20:23:53 -07:00
ipcomp6.c	…
ipv6_sockglue.c	…
mcast.c	ipv6: add support for NETDEV_RESEND_IGMP event	2017-03-28 22:02:21 -07:00
mcast_snoop.c	…
mip6.c	…
ndisc.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-04-26 22:39:08 -04:00
netfilter.c	…
output_core.c	ipv6: Prevent overrun when parsing v6 header options	2017-05-17 14:55:59 -04:00
ping.c	…
proc.c	…
protocol.c	net: Add sysctl to toggle early demux for tcp and udp	2017-03-24 13:17:07 -07:00
raw.c	ipv4, ipv6: ensure raw socket message is big enough to hold an IP header	2017-05-04 11:02:46 -04:00
reassembly.c	…
route.c	ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf	2017-05-08 17:31:24 -04:00
seg6.c	ipv6: sr: fix out-of-bounds access in SRH validation	2017-04-20 15:40:33 -04:00
seg6_hmac.c	…
seg6_iptunnel.c	ipv6: sr: fix BUG due to headroom too small after SRH push	2017-04-17 15:33:53 -04:00
sit.c	ip_tunnel: Allow policy-based routing through tunnels	2017-04-21 13:21:31 -04:00
syncookies.c	tcp: randomize timestamps on syncookies	2017-05-05 12:00:11 -04:00
sysctl_net_ipv6.c	…
tcp_ipv6.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-05-15 15:50:49 -07:00
tcpv6_offload.c	…
tunnel6.c	…
udp.c	udp: make *udp*_queue_rcv_skb() functions static	2017-05-18 10:23:33 -04:00
udp_impl.h	udp: make *udp*_queue_rcv_skb() functions static	2017-05-18 10:23:33 -04:00
udp_offload.c	ipv6: Check ip6_find_1stfragopt() return value properly.	2017-05-17 22:54:11 -04:00
udplite.c	…
xfrm6_input.c	…
xfrm6_mode_beet.c	…
xfrm6_mode_ro.c	…
xfrm6_mode_transport.c	xfrm: Add encapsulation header offsets while SKB is not encrypted	2017-04-14 10:07:39 +02:00
xfrm6_mode_tunnel.c	xfrm: Add encapsulation header offsets while SKB is not encrypted	2017-04-14 10:07:39 +02:00
xfrm6_output.c	xfrm: Add an IPsec hardware offloading API	2017-04-14 10:06:10 +02:00
xfrm6_policy.c	…
xfrm6_protocol.c	…
xfrm6_state.c	…
xfrm6_tunnel.c	…