Sabrina Dubroca
fcd91dd449
net: add recursion limit to GRO ...
Currently, GRO can do unlimited recursion through the gro_receive
handlers. This was fixed for tunneling protocols by limiting tunnel GRO
to one level with encap_mark, but both VLAN and TEB still have this
problem. Thus, the kernel is vulnerable to a stack overflow, if we
receive a packet composed entirely of VLAN headers.
This patch adds a recursion counter to the GRO layer to prevent stack
overflow. When a gro_receive function hits the recursion limit, GRO is
aborted for this skb and it is processed normally. This recursion
counter is put in the GRO CB, but could be turned into a percpu counter
if we run out of space in the CB.
Thanks to Vladimír Beneš <vbenes@redhat.com> for the initial bug report.
Fixes: CVE-2016-7039
Fixes: 9b174d88c266e5133f19
2016-10-20 14:32:22 -04:00
6lowpan: ndisc: no overreact if no short address is available
2016-09-19 20:19:34 +02:00
IB/core: add support to create a unsafe global rkey to ib_create_pd
2016-09-23 13:47:44 -04:00
net: add recursion limit to GRO
2016-10-20 14:32:22 -04:00
appletalk: use IS_ENABLED() instead of checking for built-in or module
2016-09-10 21:19:10 -07:00
lec: use IS_ENABLED() instead of checking for built-in or module
2016-09-10 21:19:10 -07:00
AX.25: Close socket connection on session completion
2016-06-18 20:55:34 -07:00
treewide: remove redundant #include <linux/kconfig.h>
2016-10-11 15:06:33 -07:00
Bluetooth: Refactor append name and appearance
2016-10-06 11:52:29 +02:00
bridge: multicast: restore perm router ports on multicast enable
2016-10-18 13:52:13 -04:00
caif: Remove unneeded header file
2016-06-28 05:26:14 -04:00
can: only call can_stat_update with procfs
2016-06-23 11:23:49 +02:00
crush: remove redundant local variable
2016-10-05 23:02:10 +02:00
net: add recursion limit to GRO
2016-10-20 14:32:22 -04:00
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2016-07-29 17:38:46 -07:00
net: fix decnet rtnexthop parsing
2016-07-05 14:08:47 -07:00
net: dsa: add port fast ageing
2016-09-23 08:38:50 -04:00
net: add recursion limit to GRO
2016-10-20 14:32:22 -04:00
net/hsr: Remove unused but set variable
2016-10-18 10:28:18 -04:00
ieee802154: 6lowpan: fix intra pan id check
2016-07-08 13:23:12 +02:00
net: add recursion limit to GRO
2016-10-20 14:32:22 -04:00
net: add recursion limit to GRO
2016-10-20 14:32:22 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2016-09-23 06:46:57 -04:00
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2016-07-29 17:38:46 -07:00
Merge branch 'work.splice_read' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-07 15:36:58 -07:00
l2tp: constify net_device_ops structures
2016-09-17 10:07:23 -04:00
net: ipv6: Remove l3mdev_get_saddr6
2016-09-10 23:12:53 -07:00
net/lapb: tuse %*ph to dump buffers
2016-05-29 22:33:25 -07:00
llc: switch type to bool as the timeout is only tested versus 0
2016-09-17 10:05:05 -04:00
mac80211: move struct aead_req off the stack
2016-10-17 16:14:04 +02:00
mac802154: use rate limited warnings for malformed frames
2016-09-19 20:19:34 +02:00
mpls: move mpls_hdr to a common location
2016-10-03 02:00:21 -04:00
net/ncsi: Improve HNCDSC AEN handler
2016-10-20 11:23:08 -04:00
netfilter: Fix slab corruption.
2016-10-11 04:44:37 -04:00
netlabel: Implement CALIPSO config functions for SMACK.
2016-06-27 15:06:18 -04:00
netlink: do not enter direct reclaim from netlink_dump()
2016-10-06 20:53:13 -04:00
NFC: digital: Fix RTOX supervisor PDU handling
2016-07-11 02:02:03 +02:00
openvswitch: add NETIF_F_HW_VLAN_STAG_TX to internal dev
2016-10-13 10:03:23 -04:00
packet: call fanout_release, while UNREGISTERING a netdev
2016-10-06 20:50:18 -04:00
Merge tag 'qcom-soc-for-4.7-2' into net-next
2016-05-17 14:11:19 -04:00
IB/core: add support to create a unsafe global rkey to ib_create_pd
2016-09-23 13:47:44 -04:00
rose: limit sk_filter trim to payload
2016-07-13 11:53:40 -07:00
rxrpc: Fix checking of error from ip6_route_output()
2016-10-13 08:43:17 +01:00
net/sched: act_mirred: Use passed lastuse argument
2016-10-20 11:14:24 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2016-10-02 22:20:41 -04:00
strparser: Propagate correct error code in strp_recv()
2016-10-12 01:51:49 -04:00
NFS client updates for Linux 4.9
2016-10-13 21:28:20 -07:00
switchdev: Execute bridge ndos only for bridge ports
2016-10-19 10:58:04 -04:00
tipc: info leak in __tipc_nl_add_udp_addr()
2016-10-13 12:10:01 -04:00
skb_splice_bits(): get rid of callback
2016-10-03 20:40:56 -04:00
VSOCK: Don't dec ack backlog twice for rejected connections
2016-09-27 07:59:25 -04:00
cfg80211: add ability to check DA/SA in A-MSDU decapsulation
2016-10-12 09:19:10 +02:00
net: x25: remove null checks on arrays calling_ae and called_ae
2016-09-09 18:13:30 -07:00
proc: Reduce cache miss in xfrm_statistics_seq_show
2016-09-30 01:50:45 -04:00
packet: compat support for sock_fprog
2016-06-09 23:41:03 -07:00
strparser: Stream parser for messages
2016-08-17 19:36:23 -04:00
strparser: Stream parser for messages
2016-08-17 19:36:23 -04:00
vfs: Remove {get,set,remove}xattr inode operations
2016-10-07 21:48:36 -04:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2016-10-06 09:52:23 -07:00
fcd91dd449