Lorenzo Bianconi 492b67e28e net: ip_gre: fix possible use-after-free in erspan_rcv ...

erspan tunnels run __iptunnel_pull_header on received skbs to remove
gre and erspan headers. This can determine a possible use-after-free
accessing pkt_md pointer in erspan_rcv since the packet will be 'uncloned'
running pskb_expand_head if it is a cloned gso skb (e.g if the packet has
been sent though a veth device). Fix it resetting pkt_md pointer after
__iptunnel_pull_header

Fixes: 1d7e2ed22f ("net: erspan: refactor existing erspan code")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2019-04-08 16:16:47 -07:00

..

bpfilter

…

netfilter

netfilter: nf_tables: merge ipv4 and ipv6 nat chain types

2019-03-01 14:36:59 +01:00

af_inet.c

gso: validate gso_type on ipip style tunnels

2019-02-20 11:24:27 -08:00

ah4.c

…

arp.c

…

cipso_ipv4.c

netlabel: fix out-of-bounds memory accesses

2019-02-27 21:45:24 -08:00

datagram.c

…

devinet.c

net: ignore sysctl_devconf_inherit_init_net without SYSCTL

2019-03-04 13:14:34 -08:00

esp4_offload.c

…

esp4.c

…

fib_frontend.c

ipv4: Return error for RTA_VIA attribute

2019-02-26 13:23:17 -08:00

fib_lookup.h

…

fib_notifier.c

…

fib_rules.c

…

fib_semantics.c

…

fib_trie.c

…

fou.c

fou, fou6: avoid uninit-value in gue_err() and gue6_err()

2019-03-08 15:19:53 -08:00

gre_demux.c

…

gre_offload.c

…

icmp.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2019-03-02 12:54:35 -08:00

igmp.c

net: remove unneeded switch fall-through

2019-02-21 13:48:00 -08:00

inet_connection_sock.c

…

inet_diag.c

…

inet_fragment.c

net: remove unused struct inet_frag_queue.fragments field

2019-02-26 08:27:05 -08:00

inet_hashtables.c

…

inet_timewait_sock.c

…

inetpeer.c

…

ip_forward.c

…

ip_fragment.c

net: remove unused struct inet_frag_queue.fragments field

2019-02-26 08:27:05 -08:00

ip_gre.c

net: ip_gre: fix possible use-after-free in erspan_rcv

2019-04-08 16:16:47 -07:00

ip_input.c

vrf: check accept_source_route on the original netdevice

2019-04-01 10:44:58 -07:00

ip_options.c

vrf: check accept_source_route on the original netdevice

2019-04-01 10:44:58 -07:00

ip_output.c

…

ip_sockglue.c

…

ip_tunnel_core.c

ip_tunnel: Add dst_cache support in lwtunnel_state of ip tunnel

2019-02-24 22:13:49 -08:00

ip_tunnel.c

iptunnel: NULL pointer deref for ip_md_tunnel_xmit

2019-03-06 10:43:06 -08:00

ip_vti.c

…

ipcomp.c

…

ipconfig.c

…

ipip.c

…

ipmr_base.c

…

ipmr.c

ipmr: ip6mr: Create new sockopt to clear mfc cache or vifs

2019-02-21 13:05:05 -08:00

Kconfig

…

Makefile

…

metrics.c

…

netfilter.c

…

netlink.c

ipv4: Add ICMPv6 support when parse route ipproto

2019-03-01 16:41:27 -08:00

ping.c

…

proc.c

…

protocol.c

…

raw_diag.c

…

raw.c

…

route.c

route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race

2019-03-08 10:50:34 -08:00

syncookies.c

tcp: handle inet_csk_reqsk_queue_add() failures

2019-03-08 16:05:10 -08:00

sysctl_net_ipv4.c

…

tcp_bbr.c

…

tcp_bic.c

…

tcp_bpf.c

…

tcp_cdg.c

…

tcp_cong.c

…

tcp_cubic.c

…

tcp_dctcp.c

tcp: Ensure DCTCP reacts to losses

2019-04-04 10:51:16 -07:00

tcp_dctcp.h

…

tcp_diag.c

…

tcp_fastopen.c

…

tcp_highspeed.c

…

tcp_htcp.c

…

tcp_hybla.c

…

tcp_illinois.c

…

tcp_input.c

tcp: handle inet_csk_reqsk_queue_add() failures

2019-03-08 16:05:10 -08:00

tcp_ipv4.c

tcp: fix a potential NULL pointer dereference in tcp_sk_exit

2019-04-01 10:11:41 -07:00

tcp_lp.c

…

tcp_metrics.c

…

tcp_minisocks.c

tcp: use tcp_md5_needed for timewait sockets

2019-02-26 13:16:03 -08:00

tcp_nv.c

…

tcp_offload.c

…

tcp_output.c

tcp: remove tcp_queue argument from tso_fragment()

2019-02-26 13:16:03 -08:00

tcp_rate.c

…

tcp_recovery.c

…

tcp_scalable.c

…

tcp_timer.c

…

tcp_ulp.c

…

tcp_vegas.c

…

tcp_vegas.h

…

tcp_veno.c

…

tcp_westwood.c

…

tcp_yeah.c

…

tcp.c

tcp: do not report TCP_CM_INQ of 0 for closed connections

2019-03-06 11:00:50 -08:00

tunnel4.c

…

udp_diag.c

…

udp_impl.h

…

udp_offload.c

…

udp_tunnel.c

…

udp.c

udp: fix possible user after free in error handler

2019-02-22 16:05:11 -08:00

udplite.c

…

xfrm4_input.c

…

xfrm4_mode_beet.c

…

xfrm4_mode_transport.c

…

xfrm4_mode_tunnel.c

…

xfrm4_output.c

…

xfrm4_policy.c

…

xfrm4_protocol.c

…

xfrm4_state.c

…

xfrm4_tunnel.c

…