Eric Dumazet
f10ce783bc
ipv4: make exception cache less predictible ...
[ Upstream commit 67d6d681e15b578c1725bad8ad079e05d1c48a8e ]
Even after commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in
fnhe_hashfun()"), an attacker can still use brute force to learn
some secrets from a victim linux host.
One way to defeat these attacks is to make the max depth of the hash
table bucket a random value.
Before this patch, each bucket of the hash table used to store exceptions
could contain 6 items under attack.
After the patch, each bucket would contains a random number of items,
between 6 and 10. The attacker can no longer infer secrets.
This is slightly increasing memory size used by the hash table,
by 50% in average, we do not expect this to be a problem.
This patch is more complex than the prior one (IPv6 equivalent),
because IPv4 was reusing the oldest entry.
Since we need to be able to evict more than one entry per
update_or_create_fnhe() call, I had to replace
fnhe_oldest() with fnhe_remove_oldest().
Also note that we will queue extra kfree_rcu() calls under stress,
which hopefully wont be a too big issue.
Fixes: 4895c771c7
2021-09-22 11:43:02 +02:00
6lowpan: Off by one handling ->nexthdr
2020-01-29 10:24:22 +01:00
net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid
2020-11-10 10:23:54 +01:00
net/802/garp: fix memleak in garp_request_join()
2021-08-04 11:58:02 +02:00
vlan: fix memory leak in vlan_dev_set_egress_priority
2020-01-12 11:24:27 +01:00
appletalk: Fix skb allocation size in loopback case
2021-04-07 12:05:39 +02:00
atm: fix a memory leak of vcc->user_back
2020-10-01 20:40:12 +02:00
AX.25: Prevent integer overflows in connect and sendmsg
2020-07-31 16:44:06 +02:00
batman-adv: Avoid WARN_ON timing related checks
2021-06-30 08:49:13 -04:00
Bluetooth: add timeout sanity check to hci_inquiry
2021-09-22 11:43:01 +02:00
net: bridge: fix memleak in br_add_if()
2021-08-26 08:37:22 -04:00
net: fix uninit-value in caif_seqpkt_sendmsg
2021-07-28 09:14:27 +02:00
can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
2021-08-08 08:38:54 +02:00
libceph: clear con->out_msg on Policy::stateful_server faults
2020-11-10 10:23:59 +01:00
net: Fix zero-copy head len calculation.
2021-08-08 08:38:53 +02:00
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
2021-01-23 15:38:18 +01:00
dccp: add do-while-0 stubs for dccp_pr_debug macros
2021-08-26 08:37:27 -04:00
net: decnet: Fix sleeping inside in af_decnet
2021-07-28 09:14:27 +02:00
KEYS: DNS: fix parsing multiple options
2018-07-22 14:27:39 +02:00
net: dsa: tag_brcm: Fix skb->fwd_offload_mark location
2020-04-13 10:32:53 +02:00
net: add annotations on hh->hh_len lockless accesses
2020-01-12 11:24:19 +01:00
hsr: use netdev_err() instead of WARN_ONCE()
2021-05-22 10:40:20 +02:00
net: Fix memory leak in ieee802154_raw_deliver
2021-08-26 08:37:22 -04:00
ipv4: make exception cache less predictible
2021-09-22 11:43:02 +02:00
ipv6: tcp: drop silly ICMPv6 packet too big messages
2021-07-28 09:14:26 +02:00
ipx: call ipxitf_put() in ioctl error path
2017-05-25 15:44:41 +02:00
irda: Only insert new objects into the global database via setsockopt
2018-09-15 09:43:01 +02:00
net/af_iucv: set correct sk_protocol for child sockets
2020-12-11 13:37:56 +01:00
kcm: switch order of device registration to fix a crash
2019-04-17 08:36:44 +02:00
af_key: relax availability checks for skb size calculation
2021-02-23 13:59:14 +01:00
l2tp: fix races with ipv4-mapped ipv6 addresses
2021-01-09 13:35:49 +01:00
net: ipv6: Remove l3mdev_get_saddr6
2016-09-10 23:12:53 -07:00
net: lapb: Copy the skb before sending a packet
2021-02-10 09:09:25 +01:00
net: llc: fix skb_over_panic
2021-08-04 11:58:03 +02:00
mac80211: drop data frames without key on encrypted links
2021-08-26 08:37:25 -04:00
net: mac802154: Fix general protection fault
2021-04-16 11:59:10 +02:00
net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0
2021-03-17 16:10:13 +01:00
net/ncsi: Use real net-device for response handler
2021-01-12 19:49:01 +01:00
netfilter: nft_nat: allow to specify layer 4 protocol NAT only
2021-08-04 11:58:03 +02:00
net: cipso: fix warnings in netlbl_cipsov4_add_std
2021-09-22 11:43:00 +02:00
netlink: disable IRQs for netlink_lock_table()
2021-06-16 11:36:33 +02:00
netrom: Decrease sock refcount when sock timers expire
2021-07-28 09:14:27 +02:00
net/nfc/rawsock.c: fix a permission check bug
2021-06-16 11:36:32 +02:00
openvswitch: fix stack OOB read while fragmenting IPv4 packets
2021-05-22 10:40:19 +02:00
net/packet: annotate accesses to po->ifindex
2021-06-30 08:49:20 -04:00
phonet: fix building with clang
2019-03-23 13:19:44 +01:00
net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()
2021-03-30 14:41:42 +02:00
net/rds: dma_map_sg is entitled to merge entries
2021-09-03 09:44:40 +02:00
rfkill: Fix incorrect check to avoid NULL pointer dereference
2020-01-12 11:24:23 +01:00
rose: Fix Null pointer dereference in rose_send_frame()
2020-12-11 13:37:56 +01:00
rxrpc: Fix handling of an unsupported token type in rxrpc_read()
2021-01-23 15:38:19 +01:00
net/sched: cls_flower: Use mask for addr_type
2021-09-22 11:42:56 +02:00
sctp: move 198 addresses from unusable to private scope
2021-08-04 11:58:02 +02:00
strparser: Fix incorrect strp->need_bytes value.
2018-04-29 11:32:02 +02:00
SUNRPC: Should wake up the privileged task firstly.
2021-07-20 16:20:57 +02:00
switchdev: Execute bridge ndos only for bridge ports
2016-10-19 10:58:04 -04:00
tipc: fix sleeping in tipc accept routine
2021-08-04 11:58:03 +02:00
af_unix: fix garbage collect vs MSG_PEEK
2021-08-04 11:58:01 +02:00
vsock/vmci: log once the failed queue pair allocation
2021-05-22 10:40:28 +02:00
cfg80211: Fix possible memory leak in function cfg80211_bss_update
2021-08-04 11:58:03 +02:00
net/x25: Return the correct errno code
2021-06-30 08:49:12 -04:00
xfrm: Fix error reporting in xfrm_state_construct.
2021-07-20 16:21:07 +02:00
net: Return the correct errno code
2021-06-30 08:49:12 -04:00
net: split out functions related to registering inflight socket files
2021-08-04 11:58:01 +02:00
net: Set fput_needed iff FDPUT_FPUT is set
2020-08-21 11:02:04 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2016-10-06 09:52:23 -07:00
f10ce783bc