WSL2-Linux-Kernel/net/ipv6
hannes@stressinduktion.org f60e5990d9 ipv6: protect skb->sk accesses from recursive dereference inside the stack
We should not consult skb->sk for output decisions in xmit recursion
levels > 0 in the stack. Otherwise local socket settings could influence
the result of e.g. tunnel encapsulation process.

ipv6 does not conform with this in three places:

1) ip6_fragment: we do consult ipv6_npinfo for frag_size

2) sk_mc_loop in ipv6 uses skb->sk and checks if we should
   loop the packet back to the local socket

3) ip6_skb_dst_mtu could query the settings from the user socket and
   force a wrong MTU

Furthermore:
In sk_mc_loop we could potentially land in WARN_ON(1) if we use a
PF_PACKET socket ontop of an IPv6-backed vxlan device.

Reuse xmit_recursion as we are currently only interested in protecting
tunnel devices.

Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-04-06 16:12:49 -04:00
..
netfilter netfilter: restore rule tracing via nfnetlink_log 2015-03-19 11:14:48 +01:00
Kconfig
Makefile
addrconf.c ipv6: addrconf: validate new MTU before applying it 2015-02-23 18:16:12 -05:00
addrconf_core.c
addrlabel.c
af_inet6.c
ah6.c
anycast.c
datagram.c ip: fix error queue empty skb handling 2015-03-08 23:01:54 -04:00
esp6.c
exthdrs.c
exthdrs_core.c
exthdrs_offload.c
fib6_rules.c net: move fib_rules_unregister() under rtnl lock 2015-04-02 20:52:34 -04:00
icmp.c
inet6_connection_sock.c
inet6_hashtables.c
ip6_checksum.c
ip6_fib.c
ip6_flowlabel.c ipv6: fix possible deadlock in ip6_fl_purge / ip6_fl_gc 2015-02-12 07:13:03 -08:00
ip6_gre.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-02-05 14:33:28 -08:00
ip6_icmp.c
ip6_input.c
ip6_offload.c
ip6_offload.h
ip6_output.c ipv6: protect skb->sk accesses from recursive dereference inside the stack 2015-04-06 16:12:49 -04:00
ip6_tunnel.c ip6_tunnel: fix error code when tunnel exists 2015-03-17 15:01:18 -04:00
ip6_udp_tunnel.c
ip6_vti.c
ip6mr.c ip6mr: call del_timer_sync() in ip6mr_free_table() 2015-04-02 20:52:35 -04:00
ipcomp6.c
ipv6_sockglue.c
mcast.c
mip6.c
ndisc.c ipv6: Don't reduce hop limit for an interface 2015-03-25 11:41:08 -04:00
netfilter.c
output_core.c ipv6: Make __ipv6_select_ident static 2015-02-09 14:21:03 -08:00
ping.c net: ping: Return EAFNOSUPPORT when appropriate. 2015-03-04 15:46:51 -05:00
proc.c
protocol.c
raw.c
reassembly.c
route.c ipv6: fix ipv6_cow_metrics for non DST_HOST case 2015-02-14 20:26:16 -08:00
sit.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-02-05 14:33:28 -08:00
syncookies.c
sysctl_net_ipv6.c
tcp_ipv6.c net: tcp6: fix double call of tcp_v6_fill_cb() 2015-03-29 13:36:05 -07:00
tcpv6_offload.c
tunnel6.c
udp.c
udp_impl.h
udp_offload.c ipv6: call ipv6_proxy_select_ident instead of ipv6_select_ident in udp6_ufo_fragment 2015-03-20 12:56:11 -04:00
udplite.c
xfrm6_input.c
xfrm6_mode_beet.c
xfrm6_mode_ro.c
xfrm6_mode_transport.c
xfrm6_mode_tunnel.c
xfrm6_output.c xfrm: Fix local error reporting crash with interfamily tunnels 2015-02-09 11:14:17 +01:00
xfrm6_policy.c xfrm6: Fix a offset value for network header in _decode_session6 2015-02-06 07:00:32 +01:00
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c