mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-10 15:49:01 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
6b222adeb9340306e2ff97127c76117abb9b3df8
linux/include/net
History
Zhiling Zou 6b222adeb9 net: cap advertised IP tunnel headroom 
IP tunnel devices derive their advertised needed_headroom from lower
output devices. A stack of user-created devices can make the derived
value larger than the 16-bit skb header offsets can represent. Once IP
output reserves it, skb head expansion can wrap those offsets.

The runtime transmit path already caps a growing needed_headroom at 512.
Apply the same cap when tunnel configuration publishes needed_headroom
derived from a lower output device.

Capping the advertised value is safe: IP tunnel transmit still expands
the skb when a packet needs more headroom. A nonsensical stacked
configuration can therefore incur an extra reallocation, but it cannot
publish an unbounded reservation to upper layers.

Fixes: 1a37e412a0 ("net: Use 16bits for *_headers fields of struct skbuff")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/ba04a1fd6bfae2377607fad5d8f80f7eb80fd4c4.1786542637.git.zhilinz@nebusec.ai
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-18 12:42:30 +02:00
..
9p
9p: Cache negative dentries for lookup performance
2026-06-21 05:22:56 +00:00
bluetooth
Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
2026-07-28 16:13:12 -04:00
iucv
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
libeth
xsk: validate metadata when processing requests
2026-08-03 16:43:54 -07:00
mana
net: mana: Sync page pool RX frags for CPU
2026-07-09 10:36:14 +02:00
netfilter
netfilter: nf_tables: make nft_object rhltable per table
2026-07-23 17:59:30 +02:00
netns
ip6mr: Define net->ipv6.{ip6mr_notifier_ops,ipmr_seq} under CONFIG_IPV6_MROUTE.
2026-06-08 17:06:24 -07:00
nfc
nfc: nci: Fix race between rfkill and nci_unregister_device().
2026-01-28 19:32:26 -08:00
page_pool
net: make page_pool_get_stats() void
2026-05-28 18:10:03 -07:00
phonet
phonet: Convert phonet_routes.lock to spinlock_t.
2024-10-24 16:03:40 +02:00
phy
net: phy: realtek: add dummy PHY driver for RTL8127ATF
2026-01-12 19:29:11 -08:00
psp
psp: add new netlink cmd for dev-assoc and dev-disassoc
2026-06-12 18:31:32 -07:00
sctp
sctp: validate cookie AUTH state before use
2026-08-07 15:02:32 -07:00
tc_act
net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
2026-07-06 12:52:01 +02:00
6lowpan.h
…
act_api.h
net/sched: act_gact, act_police: range check the fallback control action
2026-08-10 16:00:19 -07:00
addrconf.h
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
2026-08-04 14:42:45 -07:00
af_ieee802154.h
…
af_rxrpc.h
rxrpc: Remove deadcode
2025-04-24 17:03:45 -07:00
af_unix.h
af_unix: Introduce SO_INQ.
2025-07-08 18:05:25 -07:00
af_vsock.h
vsock: introduce vsock_pending_to_accept() helper
2026-06-13 10:38:27 -07:00
ah.h
…
aligned_data.h
udp: move udp_memory_allocated into net_aligned_data
2025-07-02 14:22:02 -07:00
amt.h
amt: Store struct sock in struct amt_dev.
2026-05-05 17:47:05 -07:00
arp.h
…
ax25.h
net: remove ax25 and amateur radio (hamradio) subsystem
2026-04-23 10:24:02 -07:00
ax88796.h
…
bareudp.h
…
bond_3ad.h
bonding: 3ad: implement proper RCU rules for port->aggregator
2026-04-29 18:32:02 -07:00
bond_alb.h
bonding: Correct spelling in headers
2024-08-26 09:37:22 -07:00
bond_options.h
bonding: 3ad: add lacp_strict configuration knob
2026-06-10 07:53:26 -07:00
bonding.h
bonding: 3ad: add lacp_strict configuration knob
2026-06-10 07:53:26 -07:00
bpf_sk_storage.h
…
busy_poll.h
net: gro: decouple GRO from the NAPI layer
2025-02-27 14:03:14 +01:00
calipso.h
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
can.h
can: add CAN skb extension infrastructure
2026-02-05 11:58:39 +01:00
cfg80211-wext.h
…
cfg80211.h
wifi: cfg80211: use wiphy work for socket owner autodisconnect
2026-07-07 09:27:42 +02:00
cfg802154.h
…
checksum.h
net: Fix checksum update for ILA adj-transport
2025-05-30 19:53:51 -07:00
cipso_ipv4.h
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
cls_cgroup.h
net/cls_cgroup: Fix task_get_classid() during qdisc run
2025-09-14 11:55:04 -07:00
codel_impl.h
codel: annotate data-races in codel_dump_stats()
2026-04-08 19:18:52 -07:00
codel_qdisc.h
…
codel.h
…
compat.h
…
datalink.h
…
dcbevent.h
…
dcbnl.h
…
devlink.h
devlink: Implement devlink param multi attribute nested data values
2026-06-13 16:16:58 -07:00
dropreason-core.h
ipv6: Implement limits on extension header parsing
2026-04-30 17:21:45 -07:00
dropreason-qdisc.h
net: sched: sch_dualpi2: use qdisc_dequeue_drop() for dequeue drops
2026-02-28 15:31:35 -08:00
dropreason.h
net: sched: introduce qdisc-specific drop reason tracing
2026-02-28 15:31:34 -08:00
dsa_stubs.h
…
dsa.h
net: dsa: add NETC switch tag support
2026-05-21 13:04:42 +02:00
dscp.h
…
dsfield.h
…
dst_cache.h
net: Correct spelling in headers
2024-08-26 09:37:23 -07:00
dst_metadata.h
net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone
2026-06-21 14:33:05 -07:00
dst_ops.h
net: fix __dst_negative_advice() race
2024-05-29 17:34:49 -07:00
dst.h
inet: add dst4_mtu() and dst6_mtu() helpers
2026-02-02 17:49:29 -08:00
eee.h
net: simplify eeecfg_mac_can_tx_lpi
2024-11-13 18:49:50 -08:00
erspan.h
net: Correct spelling in headers
2024-08-26 09:37:23 -07:00
esp.h
…
espintcp.h
…
ethoc.h
…
failover.h
…
fib_notifier.h
net: do not acquire rtnl in fib_seq_sum()
2024-10-11 15:35:05 -07:00
fib_rules.h
net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
2026-06-11 15:14:03 -07:00
firewire.h
…
flow_dissector.h
flow_dissector: cleanup FLOW_DISSECTOR_KEY_ENC_FLAGS
2024-07-15 09:14:39 -07:00
flow_offload.h
net: dsa: eliminate local type for tc policers
2026-02-10 15:30:11 +01:00
flow.h
ipv4: Convert ->flowi4_tos to dscp_t.
2025-08-26 17:34:31 -07:00
fou.h
…
fq_impl.h
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
fq.h
…
garp.h
…
gen_stats.h
net/sched: add const qualifiers to gnet_stats helpers
2026-05-11 18:28:08 -07:00
genetlink.h
genetlink: free the skb on 'group >= family->n_mcgrps'
2026-05-08 15:43:29 -07:00
geneve.h
…
gre.h
…
gro_cells.h
…
gro.h
gro: inline tcp6_gro_complete()
2026-01-21 19:28:32 -08:00
gso.h
…
gtp.h
…
gue.h
gue: validate REMCSUM private option length
2026-07-03 09:34:53 +01:00
handshake.h
…
hotdata.h
net-sysfs: use rps_tag_ptr and remove metadata from rps_sock_flow_table
2026-03-04 16:54:09 -08:00
hwbm.h
net: Correct spelling in headers
2024-08-26 09:37:23 -07:00
icmp.h
ipv4: icmp: Pass IPv4 control block structure as an argument to __icmp_send()
2025-09-11 12:22:38 +02:00
ieee8021q.h
…
ieee80211_radiotap.h
wifi: mac80211: add RX flag to report radiotap VHT information
2025-10-30 08:38:51 +01:00
ieee802154_netdev.h
…
if_inet6.h
…
ife.h
…
inet6_connection_sock.h
tcp: move inet6_csk_update_pmtu() to tcp_ipv6.c
2026-02-24 17:47:27 -08:00
inet6_hashtables.h
tcp: Initialise ehash secrets during connect() and listen().
2026-03-05 18:50:05 -08:00
inet_common.h
net: remove addr_len argument of recvmsg() handlers
2026-03-02 18:17:17 -08:00
inet_connection_sock.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-02-26 10:23:00 -08:00
inet_dscp.h
ipv4: Convert ->flowi4_tos to dscp_t.
2025-08-26 17:34:31 -07:00
inet_ecn.h
tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers
2026-02-03 15:13:24 +01:00
inet_frag.h
inet: frags: flush pending skbs in fqdir_pre_exit()
2025-12-10 01:15:27 -08:00
inet_hashtables.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-03-26 12:09:57 -07:00
inet_sock.h
ipv6: colocate inet6_cork in inet_cork_full
2026-02-02 17:49:30 -08:00
inet_timewait_sock.h
tcp: Update bind bucket state on port release
2025-09-23 10:12:15 +02:00
inetpeer.h
inetpeer: remove create argument of inet_getpeer()
2024-12-17 19:37:00 -08:00
ioam6.h
ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
2026-02-13 12:24:05 -08:00
ip6_checksum.h
udp: move udp6_csum_init() back to net/ipv6/udp.c
2026-02-24 16:30:40 -08:00
ip6_fib.h
ipv6: remove ipv6_stub infrastructure completely
2026-03-29 11:21:24 -07:00
ip6_route.h
ipv6: prepare headers for ipv6_stub removal
2026-03-29 11:21:23 -07:00
ip6_tunnel.h
net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT
2026-03-14 08:38:06 -07:00
ip_fib.h
ipv4: fib: Don't ignore error route in local/main tables.
2026-06-22 18:37:36 -07:00
ip_tunnels.h
net: cap advertised IP tunnel headroom
2026-08-18 12:42:30 +02:00
ip_vs.h
ipvs: revalidate ihl to prevent out-of-bounds access
2026-08-10 20:27:15 +02:00
ip.h
net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros
2026-03-29 11:21:22 -07:00
ipcomp.h
xfrm: ipcomp: Use crypto_acomp interface
2025-03-21 17:36:49 +08:00
ipconfig.h
…
ipv6_frag.h
inet: frags: flush pending skbs in fqdir_pre_exit()
2025-12-10 01:15:27 -08:00
ipv6.h
tcp: rehash onto different local ECMP path on retransmit timeout
2026-06-15 15:57:31 -07:00
iw_handler.h
Revert "wifi: cfg80211: unexport wireless_nlevent_flush()"
2024-10-09 08:53:01 +02:00
kcm.h
net: kcm: Fix race condition in kcm_unattach()
2025-08-13 18:18:33 -07:00
l3mdev.h
net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out()
2026-02-02 17:09:11 -08:00
lag.h
…
lapb.h
net: lapb: increase LAPB_HEADER_LEN
2024-12-06 17:43:08 -08:00
llc_c_ac.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_c_ev.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_c_st.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_conn.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_if.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_pdu.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_s_ac.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_s_ev.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_s_st.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_sap.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc.h
llc: Add SPDX id lines to some llc source files
2026-05-26 17:26:57 -07:00
lwtunnel.h
net: dst: annotate data-races around dst->output
2025-07-02 14:32:30 -07:00
mac80211.h
wifi: mac80211: Add 802.3 multicast encapsulation offload support
2026-06-05 16:12:26 +02:00
mac802154.h
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
macsec.h
macsec: use rcu_work to defer TX SA crypto cleanup out of softirq
2026-05-13 19:03:05 -07:00
mctp.h
net: mctp: fix don't require received header reserved bits to be zero
2026-04-20 11:46:57 -07:00
mctpdevice.h
net: mctp: Expose transport binding identifier via IFLA attribute
2024-11-09 09:04:54 -08:00
mip6.h
…
mld.h
ipv6: mld: encode multicast exponential fields
2026-05-04 19:09:41 -07:00
mpls_iptunnel.h
…
mpls.h
…
mptcp.h
tcp: allow mptcp to drop TS for some packets
2026-06-11 15:33:37 -07:00
mrp.h
…
ncsi.h
net: ncsi: Set ncsi_stop_dev() to inline while NET_NCSI not enabled
2026-06-09 17:18:51 -07:00
ndisc.h
ipv6: remove ipv6_stub infrastructure completely
2026-03-29 11:21:24 -07:00
neighbour_tables.h
neighbour: Create netdev->neighbour association
2024-11-09 13:22:57 -08:00
neighbour.h
netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()
2026-05-16 13:22:50 +02:00
net_debug.h
Merge tag 'kbuild-v6.13' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
2024-11-30 13:41:50 -08:00
net_failover.h
…
net_namespace.h
kernfs: pass struct ns_common instead of const void * for namespace tags
2026-04-09 14:36:52 +02:00
net_ratelimit.h
…
net_shaper.h
net: shaper: rework the VALID marking (again)
2026-05-20 16:34:20 -07:00
net_trackers.h
…
netdev_lock.h
net: ethtool: make dev->hwprov ops-protected
2026-06-09 10:13:04 -07:00
netdev_netlink.h
net: add granular lock for the netdev netlink socket
2025-03-12 13:32:35 -07:00
netdev_queues.h
net: Proxy netdev_queue_get_dma_dev for leased queues
2026-04-09 18:21:46 -07:00
netdev_rx_queue.h
net: remove the netif_get_rx_queue_lease_locked() helpers
2026-04-09 18:26:28 -07:00
netevent.h
…
netkit.h
…
netlabel.h
Merge tag 'net-next-6.13' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2024-11-21 08:28:08 -08:00
netlink.h
netlink: add one debug check in nla_nest_end()
2026-05-14 16:49:26 -07:00
netmem.h
Revert "mm: introduce a new page type for page pool in page type"
2026-05-21 19:06:13 -07:00
netprio_cgroup.h
…
nexthop.h
ipv6: Protect nh->f6i_list with spinlock and flag.
2025-04-24 09:29:56 +02:00
nl802154.h
nl802154: fix some kernel-doc warnings
2025-10-20 17:13:40 -07:00
nsh.h
net: nsh: fix incorrect header length macros
2026-05-08 15:32:59 -07:00
pfcp.h
net: pfcp: fix typo in message_priority field name
2025-06-13 18:17:08 -07:00
pie.h
net/sched: sch_pie: annotate data-races in pie_dump_stats()
2026-04-22 21:12:47 -07:00
ping.h
net: remove addr_len argument of recvmsg() handlers
2026-03-02 18:17:17 -08:00
pkt_cls.h
net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
2026-07-20 18:16:43 -07:00
pkt_sched.h
net/sched: don't use dynamic lockdep keys with clsact/ingress/noqueue
2026-02-05 09:32:45 -08:00
pptp.h
…
proto_memory.h
net: Allow opt-out from global protocol memory accounting.
2025-10-16 12:04:47 -07:00
protocol.h
…
psample.h
net: psample: fix flag being set in wrong skb
2024-07-11 18:11:31 -07:00
psnap.h
…
psp.h
psp: base PSP device support
2025-09-18 12:32:06 +02:00
raw.h
net: use NUMA drop counters for softnet_data.dropped
2025-09-14 11:35:17 -07:00
rawv6.h
…
red.h
net: sched: Correct spelling in headers
2024-08-26 09:37:23 -07:00
regulatory.h
net: Correct spelling in headers
2024-08-26 09:37:23 -07:00
request_sock.h
tcp: move __reqsk_free() out of line
2026-02-05 09:23:06 -08:00
rose.h
net: remove ax25 and amateur radio (hamradio) subsystem
2026-04-23 10:24:02 -07:00
route.h
ipv4: fix use-after-free in fib_nhc_update_mtu()
2026-08-11 11:25:10 +02:00
rpl.h
…
rps-types.h
net: add rps_tag_ptr type and helpers
2026-03-04 16:54:09 -08:00
rps.h
net-sysfs: use rps_tag_ptr and remove metadata from rps_dev_flow_table
2026-03-04 16:54:10 -08:00
rsi_91x.h
…
rstreason.h
net: Retire DCCP socket.
2025-04-11 18:58:10 -07:00
rtnetlink.h
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
2026-06-17 16:01:52 -07:00
rtnh.h
…
sch_generic.h
net/sched: reject overly deep qdisc hierarchies
2026-08-06 15:24:44 +02:00
sch_priv.h
net/sched: Export mq functions for reuse
2026-01-13 11:54:29 +01:00
scm.h
af_unix/scm: fix whitespace errors
2025-07-04 09:32:35 +02:00
secure_seq.h
tcp: secure_seq: add back ports to TS offset
2026-03-04 17:44:35 -08:00
seg6_hmac.h
ipv6: sr: Prepare HMAC key ahead of time
2025-08-26 18:11:29 -07:00
seg6_local.h
seg6: Use nested-BH locking for seg6_bpf_srh_states.
2024-06-24 16:41:23 -07:00
seg6.h
ipv6: sr: restruct ifdefines
2024-05-30 18:29:38 -07:00
selftests.h
net: selftests: export packet creation helpers for driver use
2025-11-06 13:38:11 +01:00
slhc_vj.h
…
smc.h
smc: Use flexible array for SMCD connections
2026-05-20 17:13:18 -07:00
snmp.h
net: snmp: remove SNMP_MIB_SENTINEL
2025-09-08 18:06:21 -07:00
sock_reuseport.h
net: core: annotate socks of struct sock_reuseport with __counted_by
2024-08-02 17:16:59 -07:00
sock.h
tcp: rehash onto different local ECMP path on retransmit timeout
2026-06-15 15:57:31 -07:00
stp.h
…
strparser.h
strparser: Remove unused __strp_unpause
2025-05-05 16:48:12 -07:00
switchdev.h
bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign
2026-03-19 13:14:00 +01:00
tc_wrapper.h
net/sched: refine indirect call mitigation in tc_wrapper.h
2026-03-09 19:31:41 -07:00
tcp_ao.h
tcp: restore RCU grace period in tcp_ao_destroy_sock
2026-06-29 18:14:30 -07:00
tcp_ecn.h
tcp: annotate data-races around tp->delivered and tp->delivered_ce
2026-04-18 11:10:12 -07:00
tcp_states.h
…
tcp.h
tcp: challenge ACK for non-exact RST in SYN-RECEIVED
2026-07-23 08:27:22 -07:00
tcx.h
bpf: Remove location field in tcx_link
2025-07-11 11:00:57 -07:00
timewait_sock.h
tcp: Remove timewait_sock_ops.twsk_destructor().
2025-08-25 17:53:35 -07:00
tipc.h
…
tls_prot.h
…
tls.h
tls: remove tls_toe and the related driver
2026-06-12 16:43:10 -07:00
transp_v6.h
ipv6: Retire UDP-Lite.
2026-03-13 18:57:44 -07:00
tso.h
net: tso: Introduce tso_dma_map and helpers
2026-04-12 10:54:31 -07:00
tun_proto.h
…
udp_tunnel.h
udp_tunnel: Pass struct sock to udp_tunnel_notify_{add,del}_rx_port().
2026-05-05 17:47:04 -07:00
udp.h
udp: Don't pass udptable to IPv4 socket lookup functions.
2026-03-13 18:57:46 -07:00
vsock_addr.h
net: Convert proto_ops connect() callbacks to use sockaddr_unsized
2025-11-04 19:10:32 -08:00
vxlan.h
vxlan: Free vxlan_sock with kfree_rcu().
2026-05-05 17:47:05 -07:00
wext.h
…
x25.h
net/x25: Remove unused x25_terminate_link()
2025-07-14 17:19:13 -07:00
x25device.h
…
xdp_priv.h
…
xdp_sock_drv.h
xsk: validate metadata when processing requests
2026-08-03 16:43:54 -07:00
xdp_sock.h
xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h
2026-08-03 16:43:54 -07:00
xdp.h
Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2025-09-24 10:22:37 -07:00
xfrm.h
xfrm: cache the offload ifindex for netlink dumps
2026-07-02 09:12:58 +02:00
xsk_buff_pool.h
xsk: reclaim invalid Tx descriptors in ZC batch path
2026-07-24 15:12:14 -07:00