linux/net/ipv4
Eric Dumazet 64199fc0a4 ipv4: fix use-after-free in ip_cmsg_recv_dstaddr()
Caching ip_hdr(skb) before a call to pskb_may_pull() is buggy,
do not do it.

Fixes: 2efd4fca70 ("ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-10-02 22:32:05 -07:00
..
bpfilter bpfilter: remove trailing newline 2018-07-24 14:10:42 -07:00
netfilter netfilter: kconfig: nat related expression depend on nftables core 2018-08-31 19:07:10 +02:00
Kconfig net: remove blank lines at end of file 2018-07-24 14:10:43 -07:00
Makefile net: remove blank lines at end of file 2018-07-24 14:10:43 -07:00
af_inet.c gso_segment: Reset skb->mac_len after modifying network header 2018-09-13 12:09:32 -07:00
ah4.c
arp.c proc: introduce proc_create_net{,_data} 2018-05-16 07:24:30 +02:00
cipso_ipv4.c
datagram.c
devinet.c route: add support for directed broadcast forwarding 2018-07-29 12:37:06 -07:00
esp4.c
esp4_offload.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 2018-07-27 09:33:37 -07:00
fib_frontend.c ipv4: remove BUG_ON() from fib_compute_spec_dst 2018-07-28 19:06:12 -07:00
fib_lookup.h
fib_notifier.c
fib_rules.c net: fib_rules: add extack support 2018-04-23 10:21:24 -04:00
fib_semantics.c net: metrics: add proper netlink validation 2018-06-05 12:29:43 -04:00
fib_trie.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-06-06 18:39:49 -07:00
fou.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net 2018-07-03 10:29:26 +09:00
gre_demux.c
gre_offload.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net 2018-07-03 10:29:26 +09:00
icmp.c ipv4: ipcm_cookie initializers 2018-07-07 10:58:49 +09:00
igmp.c igmp: fix incorrect unsolicit report count after link down and up 2018-09-02 13:39:37 -07:00
inet_connection_sock.c inet: make sure to grab rcu_read_lock before using ireq->ireq_opt 2018-10-02 15:52:12 -07:00
inet_diag.c
inet_fragment.c ip: process in-order fragments efficiently 2018-08-11 17:54:18 -07:00
inet_hashtables.c bpf: Enable BPF_PROG_TYPE_SK_REUSEPORT bpf prog in reuseport selection 2018-08-11 01:58:46 +02:00
inet_timewait_sock.c soreuseport: initialise timewait reuseport field 2018-04-07 22:32:32 -04:00
inetpeer.c inetpeer: fix uninit-value in inet_getpeer 2018-04-09 10:57:35 -04:00
ip_forward.c net: ipv4: Control SKB reprioritization after forwarding 2018-08-01 09:52:30 -07:00
ip_fragment.c ip: frags: fix crash in ip_do_fragment() 2018-09-09 14:50:56 -07:00
ip_gre.c erspan: fix error handling for erspan tunnel 2018-09-11 23:50:54 -07:00
ip_input.c net: ipv4: fix listify ip_rcv_finish in case of forwarding 2018-07-12 16:40:19 -07:00
ip_options.c
ip_output.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net 2018-07-24 19:21:58 -07:00
ip_sockglue.c ipv4: fix use-after-free in ip_cmsg_recv_dstaddr() 2018-10-02 22:32:05 -07:00
ip_tunnel.c ip_tunnel: be careful when accessing the inner header 2018-09-24 12:27:04 -07:00
ip_tunnel_core.c net/ipv4: Update ip_tunnel_metadata_cnt static key to modern api 2018-05-10 15:13:33 -04:00
ip_vti.c ip_vti: fix a null pointer deferrence when create vti fallback tunnel 2018-08-19 11:26:39 -07:00
ipcomp.c
ipconfig.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-06-06 18:39:49 -07:00
ipip.c
ipmr.c net: ipmr: add support for passing full packet on wrong vif 2018-07-13 14:21:16 -07:00
ipmr_base.c rhashtable: split rhashtable.h 2018-06-22 13:43:27 +09:00
metrics.c net: metrics: add proper netlink validation 2018-06-05 12:29:43 -04:00
netfilter.c netfilter: utils: move nf_ip_checksum* from ipv4 to utils 2018-07-16 17:51:48 +02:00
netlink.c ipv4: support sport, dport and ip_proto in RTM_GETROUTE 2018-05-23 15:14:12 -04:00
ping.c net: add helpers checking if socket can be bound to nonlocal address 2018-08-01 09:50:04 -07:00
proc.c ip: discard IPv4 datagrams with overlapping segments. 2018-08-05 17:16:46 -07:00
protocol.c
raw.c ip: remove tx_flags from ipcm_cookie and use same logic for v4 and v6 2018-07-07 10:58:49 +09:00
raw_diag.c
route.c route: add support for directed broadcast forwarding 2018-07-29 12:37:06 -07:00
syncookies.c
sysctl_net_ipv4.c net-tcp: /proc/sys/net/ipv4/tcp_probe_interval is a u32 not int 2018-09-26 20:33:21 -07:00
tcp.c tcp: really ignore MSG_ZEROCOPY if no SO_ZEROCOPY 2018-09-07 23:11:06 -07:00
tcp_bbr.c tcp_bbr: apply PROBE_RTT cwnd cap even if acked==0 2018-08-22 21:45:32 -07:00
tcp_bic.c
tcp_cdg.c
tcp_cong.c
tcp_cubic.c
tcp_dctcp.c tcp: avoid resetting ACK timer in DCTCP 2018-08-11 11:31:35 -07:00
tcp_diag.c
tcp_fastopen.c
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c
tcp_input.c tcp/dccp: fix lockdep issue when SYN is backlogged 2018-10-01 15:42:13 -07:00
tcp_ipv4.c inet: make sure to grab rcu_read_lock before using ireq->ireq_opt 2018-10-02 15:52:12 -07:00
tcp_lp.c
tcp_metrics.c
tcp_minisocks.c tcp: do not restart timewait timer on rst reception 2018-08-31 23:10:35 -07:00
tcp_nv.c
tcp_offload.c tcp: Don't coalesce decrypted and encrypted SKBs 2018-07-16 00:12:09 -07:00
tcp_output.c tcp: remove set but not used variable 'skb_size' 2018-08-01 09:57:09 -07:00
tcp_rate.c tcp: expose both send and receive intervals for rate sample 2018-07-11 23:01:56 -07:00
tcp_recovery.c tcp: add stat of data packet reordering events 2018-08-01 09:56:10 -07:00
tcp_scalable.c
tcp_timer.c tcp: make function tcp_retransmit_stamp() static 2018-07-25 16:35:45 -07:00
tcp_ulp.c tcp, ulp: fix leftover icsk_ulp_ops preventing sock from reattach 2018-08-16 14:58:08 -07:00
tcp_vegas.c
tcp_vegas.h
tcp_veno.c
tcp_westwood.c
tcp_yeah.c
tunnel4.c
udp.c udp4: fix IP_CMSG_CHECKSUM for connected sockets 2018-09-16 15:27:44 -07:00
udp_diag.c udp: fix rx queue len reported by diag and proc interface 2018-06-08 19:55:15 -04:00
udp_impl.h
udp_offload.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net 2018-07-03 10:29:26 +09:00
udp_tunnel.c
udplite.c proc: introduce proc_create_net{,_data} 2018-05-16 07:24:30 +02:00
xfrm4_input.c xfrm: reset transport header back to network header after all input transforms ahave been applied 2018-09-04 10:26:30 +02:00
xfrm4_mode_beet.c
xfrm4_mode_transport.c xfrm: reset transport header back to network header after all input transforms ahave been applied 2018-09-04 10:26:30 +02:00
xfrm4_mode_tunnel.c
xfrm4_output.c
xfrm4_policy.c
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c