Michael Scott
3e8e438d8a
6lowpan: iphc: reset mac_header after decompress to fix panic ...
[ Upstream commit 03bc05e1a4972f73b4eb8907aa373369e825c252 ]
After decompression of 6lowpan socket data, an IPv6 header is inserted
before the existing socket payload. After this, we reset the
network_header value of the skb to account for the difference in payload
size from prior to decompression + the addition of the IPv6 header.
However, we fail to reset the mac_header value.
Leaving the mac_header value untouched here, can cause a calculation
error in net/packet/af_packet.c packet_rcv() function when an
AF_PACKET socket is opened in SOCK_RAW mode for use on a 6lowpan
interface.
On line 2088, the data pointer is moved backward by the value returned
from skb_mac_header(). If skb->data is adjusted so that it is before
the skb->head pointer (which can happen when an old value of mac_header
is left in place) the kernel generates a panic in net/core/skbuff.c
line 1717.
This panic can be generated by BLE 6lowpan interfaces (such as bt0) and
802.15.4 interfaces (such as lowpan0) as they both use the same 6lowpan
sources for compression and decompression.
Signed-off-by: Michael Scott <michael@opensourcefoundries.com>
Acked-by: Alexander Aring <aring@mojatatu.com>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-03 17:01:42 -07:00
6lowpan: iphc: reset mac_header after decompress to fix panic
2018-10-03 17:01:42 -07:00
net/9p: fix error path of p9_virtio_probe
2018-09-15 09:42:58 +02:00
vlan: also check phy_driver ts_info for vlan's real device
2018-04-13 19:48:34 +02:00
appletalk: use IS_ENABLED() instead of checking for built-in or module
2016-09-10 21:19:10 -07:00
net: atm: Fix potential Spectre v1
2018-05-16 10:08:44 +02:00
ax25: Fix segfault after sock connection timeout
2017-02-04 09:47:09 +01:00
batman-adv: Fix bat_v best gw refcnt after netlink dump
2018-08-24 13:12:31 +02:00
Bluetooth: hidp: Fix handling of strncpy for hid->name information
2018-09-19 22:47:14 +02:00
netfilter: ebtables: reject non-bridge targets
2018-07-22 14:27:39 +02:00
net: caif: Add a missing rcu_read_unlock() in caif_flow_cb
2018-09-05 09:20:00 +02:00
can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once
2018-01-31 12:55:50 +01:00
libceph: validate con->state at the top of try_write()
2018-05-01 15:13:09 -07:00
neighbour: confirm neigh entries when ARP packet is received
2018-09-29 03:07:33 -07:00
net: dcb: For wild-card lookups, use priority -1, not 0
2018-09-19 22:47:15 +02:00
dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart()
2018-08-22 07:47:13 +02:00
dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
2018-02-25 11:05:44 +01:00
KEYS: DNS: fix parsing multiple options
2018-07-22 14:27:39 +02:00
net: dsa: Do not suspend/resume closed slave_dev
2018-08-06 16:23:03 +02:00
net: introduce device min_header_len
2017-02-18 15:11:43 +01:00
hsr: fix incorrect warning
2018-04-13 19:48:29 +02:00
net: 6lowpan: fix reserved space for single frames
2018-09-09 20:01:19 +02:00
udp4: fix IP_CMSG_CHECKSUM for connected sockets
2018-09-29 03:07:33 -07:00
ipv6: fix possible use-after-free in ip6_xmit()
2018-09-29 03:07:32 -07:00
ipx: call ipxitf_put() in ioctl error path
2017-05-25 15:44:41 +02:00
irda: Only insert new objects into the global database via setsockopt
2018-09-15 09:43:01 +02:00
net/iucv: Free memory obtained by kzalloc
2018-03-31 18:11:34 +02:00
kcm: Fix use-after-free caused by clonned sockets
2018-06-13 16:16:42 +02:00
af_key: Always verify length of provided sadb_key
2018-06-16 09:52:32 +02:00
l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache
2018-08-22 07:47:13 +02:00
net: ipv6: Remove l3mdev_get_saddr6
2016-09-10 23:12:53 -07:00
llc: use refcount_inc_not_zero() for llc_sap_find()
2018-08-22 07:47:13 +02:00
mac80211: restrict delayed tailroom needed decrement
2018-09-26 08:36:33 +02:00
net: mac802154: tx: expand tailroom if necessary
2018-09-09 20:01:19 +02:00
mpls, nospec: Sanitize array index in mpls_label_ok()
2018-03-11 16:21:34 +01:00
net/ncsi: Improve HNCDSC AEN handler
2016-10-20 11:23:08 -04:00
netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user
2018-09-19 22:47:16 +02:00
netlabel: If PF_INET6, check sk_buff ip header version
2018-05-30 07:50:51 +02:00
netlink: Don't shift on 64 for ngroups
2018-08-09 12:17:59 +02:00
NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
2018-09-29 03:07:30 -07:00
openvswitch: Remove padding from packet before L3+ conntrack processing
2018-05-30 07:50:23 +02:00
packet: refine ring v3 block size test to hold one frame
2018-08-24 13:12:41 +02:00
net: qrtr: Broadcast messages only from control port
2018-08-24 13:12:36 +02:00
rds: fix two RCU related problems
2018-09-26 08:36:30 +02:00
rfkill: gpio: fix memory leak in probe error path
2018-05-16 10:08:43 +02:00
rose: limit sk_filter trim to payload
2016-07-13 11:53:40 -07:00
rxrpc: Don't treat call aborts as conn aborts
2018-05-30 07:50:42 +02:00
sch_tbf: fix two null pointer dereferences on init failure
2018-09-15 09:43:06 +02:00
sctp: hold transport before accessing its asoc in sctp_transport_get_next
2018-09-15 09:42:56 +02:00
strparser: Fix incorrect strp->need_bytes value.
2018-04-29 11:32:02 +02:00
sunrpc: Don't use stack buffer with scatterlist
2018-09-15 09:42:57 +02:00
switchdev: Execute bridge ndos only for bridge ports
2016-10-19 10:58:04 -04:00
tipc: add policy for TIPC_NLA_NET_ADDR
2018-04-29 11:32:01 +02:00
net/unix: don't show information about sockets from other namespaces
2017-11-18 11:22:22 +01:00
vsock: split dwork to avoid reinitializations
2018-08-22 07:47:13 +02:00
nl80211: fix null-ptr dereference on invalid mesh configuration
2018-09-19 22:47:11 +02:00
net: x25: fix one potential use-after-free issue
2018-04-13 19:48:00 +02:00
xfrm: fix 'passing zero to ERR_PTR()' warning
2018-09-26 08:36:31 +02:00
net: support compat 64-bit time in {s,g}etsockopt
2018-05-19 10:26:58 +02:00
strparser: Stream parser for messages
2016-08-17 19:36:23 -04:00
strparser: Stream parser for messages
2016-08-17 19:36:23 -04:00
net: socket: fix potential spectre v1 gadget in socketcall
2018-08-06 16:23:04 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2016-10-06 09:52:23 -07:00
3e8e438d8a