Herbert Xu
66a675d390
xfrm: Use correct address family in xfrm_state_find ...
[ Upstream commit e94ee171349db84c7cfdc5fefbebe414054d0924 ]
The struct flowi must never be interpreted by itself as its size
depends on the address family. Therefore it must always be grouped
with its original family value.
In this particular instance, the original family value is lost in
the function xfrm_state_find. Therefore we get a bogus read when
it's coupled with the wrong family which would occur with inter-
family xfrm states.
This patch fixes it by keeping the original family value.
Note that the same bug could potentially occur in LSM through
the xfrm_state_pol_flow_match hook. I checked the current code
there and it seems to be safe for now as only secid is used which
is part of struct flowi_common. But that API should be changed
so that so that we don't get new bugs in the future. We could
do that by replacing fl with just secid or adding a family field.
Reported-by: syzbot+577fbac3145a6eb2e7a5@syzkaller.appspotmail.com
Fixes: 48b8d78315
2020-10-14 10:31:25 +02:00
6lowpan: Off by one handling ->nexthdr
2020-01-27 14:50:41 +01:00
net/9p: validate fds in p9_fd_open
2020-08-11 15:32:32 +02:00
vlan: vlan_changelink() should propagate errors
2020-01-12 12:17:28 +01:00
appletalk: Set error code if register_snap_client failed
2019-12-13 08:52:59 +01:00
atm: fix a memory leak of vcc->user_back
2020-10-01 13:14:43 +02:00
AX.25: Prevent integer overflows in connect and sendmsg
2020-07-31 18:37:48 +02:00
batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
2020-10-01 13:14:52 +02:00
Bluetooth: Handle Inquiry Cancel error after Inquiry Complete
2020-10-01 13:14:44 +02:00
bpf/test_run: support cgroup local storage
2018-08-03 00:47:32 +02:00
signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig
2020-01-27 14:50:51 +01:00
net: bridge: enfore alignment for ethernet address
2020-06-30 23:17:03 -04:00
net: use skb_queue_empty_lockless() in poll() handlers
2019-11-10 11:27:48 +01:00
can: gw: Fix error path of cgw_module_init
2019-08-29 08:28:30 +02:00
libceph: don't omit recovery_deletes in target_copy()
2020-07-22 09:32:13 +02:00
bpf: Fix clobbering of r2 in bpf_gen_ld_abs
2020-10-01 13:14:52 +02:00
net: DCB: Validate DCB_ATTR_DCB_BUFFER argument
2020-09-26 18:01:29 +02:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2020-04-29 16:31:16 +02:00
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:13:37 +01:00
KEYS: Don't write out to userspace while holding key semaphore
2020-04-23 10:30:24 +02:00
dsa: Allow forwarding of redirected IGMP traffic
2020-09-23 12:10:56 +02:00
net: add annotations on hh->hh_len lockless accesses
2020-01-09 10:19:09 +01:00
hsr: check protocol version in hsr_newlink()
2020-04-21 09:03:03 +02:00
nl802154: add missing attribute validation for dev_type
2020-03-18 07:14:15 +01:00
rt_cpu_seq_next should increase position index
2020-10-01 13:14:29 +02:00
ipv6_route_seq_next should increase position index
2020-10-01 13:14:29 +02:00
net/af_iucv: always register net_device notifier
2020-01-27 14:50:56 +01:00
kcm: switch order of device registration to fix a crash
2019-04-17 08:38:40 +02:00
af_key: pfkey_dump needs parameter validation
2020-09-26 18:01:28 +02:00
l2tp: remove skb_dst_set() from l2tp_xmit_skb()
2020-07-22 09:31:59 +02:00
lapb: fixed leak of control-blocks.
2019-06-22 08:15:13 +02:00
net: silence data-races on sk_backlog.tail
2020-10-01 13:14:26 +02:00
mac80211: do not allow bigger VHT MPDUs than the hardware supports
2020-10-07 08:00:07 +02:00
mac802154: tx: fix use-after-free
2020-10-01 13:14:51 +02:00
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
2020-04-29 16:31:17 +02:00
net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler
2018-08-22 21:39:08 -07:00
netfilter: ctnetlink: add a range check for l3/l4 protonum
2020-10-07 08:00:09 +02:00
netlabel: fix problems with mapping removal
2020-09-12 13:40:22 +02:00
genetlink: remove genl_bind
2020-07-22 09:31:58 +02:00
net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
2020-04-29 16:31:21 +02:00
net/nfc/rawsock.c: add CAP_NET_RAW check.
2020-08-19 08:15:03 +02:00
nsh: set mac len based on inner packet
2018-07-12 16:55:29 -07:00
openvswitch: handle DNAT tuple collision
2020-10-14 10:31:24 +02:00
net/packet: fix overflow in tpacket_rcv
2020-10-07 08:00:08 +02:00
net: use skb_queue_empty_lockless() in poll() handlers
2019-11-10 11:27:48 +01:00
net: psample: fix skb_over_panic
2019-12-05 09:21:30 +01:00
net: qrtr: check skb_put_padto() return value
2020-09-26 18:01:30 +02:00
rds: Prevent kernel-infoleak in rds_notify_queue_get()
2020-08-05 10:06:01 +02:00
rfkill: Fix incorrect check to avoid NULL pointer dereference
2020-01-12 12:17:17 +01:00
net/rose: fix unbound loop in rose_loopback_timer()
2019-05-02 09:59:00 +02:00
rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
2020-08-11 15:32:35 +02:00
net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc
2020-09-26 18:01:30 +02:00
sctp: fix sctp_auth_init_hmacs() error path
2020-10-14 10:31:23 +02:00
net/smc: Prevent kernel-infoleak in __smc_diag_dump()
2020-09-03 11:24:17 +02:00
net: strparser: partially revert "strparser: Call skb_unclone conditionally"
2019-05-16 19:41:27 +02:00
svcrdma: Fix leak of transport addresses
2020-10-01 13:14:40 +02:00
tipc: fix memory leak in service subscripting
2020-10-01 13:14:44 +02:00
net/tls: Fix kmap usage
2020-08-19 08:15:03 +02:00
skbuff: fix a data race in skb_queue_len()
2020-10-01 13:14:32 +02:00
net: virtio_vsock: Enhance connection semantics
2020-10-07 08:00:05 +02:00
wimax: remove blank lines at EOF
2018-07-24 14:10:42 -07:00
net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()
2020-10-14 10:31:21 +02:00
net/x25: Fix null-ptr-deref in x25_disconnect
2020-08-05 10:06:02 +02:00
xdp: Fix xsk_generic_xmit errno
2020-06-25 15:33:05 +02:00
xfrm: Use correct address family in xfrm_state_find
2020-10-14 10:31:25 +02:00
net/compat: Add missing sock updates for SCM_RIGHTS
2020-08-21 11:05:32 +02:00
net: remove blank lines at end of file
2018-07-24 14:10:43 -07:00
bpfilter: check compiler capability in Kconfig
2018-06-28 13:36:39 +09:00
net: Set fput_needed iff FDPUT_FPUT is set
2020-08-19 08:15:03 +02:00
66a675d390