kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net/ipv6
History
Zhengchuan Liang 7d6a57411c netfilter: ip6t_eui64: reject invalid MAC header for all packets 
[ Upstream commit fdce0b3590 ]

`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address
and compares it with the low 64 bits of the IPv6 source address.

The existing guard only rejects an invalid MAC header when
`par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()`
can still reach `eth_hdr(skb)` even when the MAC header is not valid.

Fix this by removing the `par->fragoff != 0` condition so that packets
with an invalid MAC header are rejected before accessing `eth_hdr(skb)`.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-06-01 17:35:03 +02:00
..
ila net: Fix checksum update for ILA adj-transport 2025-06-27 11:05:38 +01:00
netfilter netfilter: ip6t_eui64: reject invalid MAC header for all packets 2026-06-01 17:35:03 +02:00
addrconf.c ipv6: prevent possible UaF in addrconf_permanent_addr() 2026-04-18 10:33:29 +02:00
addrconf_core.c ipv6: Ensure natural alignment of const ipv6 loopback and router addresses 2024-02-23 08:54:54 +01:00
addrlabel.c ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network 2022-11-16 09:58:18 +01:00
af_inet6.c net: inet6: do not leave a dangling sk pointer in inet6_create() 2024-12-14 19:51:37 +01:00
ah6.c net: ipv6: fix field-spanning memcpy warning in AH output 2025-12-07 06:09:19 +09:00
anycast.c ipv6: fix memory leaks on IPV6_ADDRFORM path 2020-07-30 16:30:55 -07:00
calipso.c ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() 2026-01-19 13:09:57 +01:00
datagram.c ipv6: avoid overflows in ip6_datagram_send_ctl() 2026-04-18 10:33:31 +02:00
esp6.c xfrm: esp: avoid in-place decrypt on shared skb frags 2026-05-08 12:46:21 +02:00
esp6_offload.c xfrm: Linearize the skb after offloading if needed. 2023-06-28 10:29:46 +02:00
exthdrs.c ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() 2026-03-04 07:20:36 -05:00
exthdrs_core.c ipv6: Fix out-of-bounds access in ipv6_find_tlv() 2023-05-30 13:55:31 +01:00
exthdrs_offload.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
fib6_notifier.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
fib6_rules.c ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). 2025-06-04 14:38:03 +02:00
fou6.c net: Add MODULE_DESCRIPTION entries to network modules 2020-06-20 21:33:57 -07:00
icmp.c ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() 2026-04-18 10:33:29 +02:00
inet6_connection_sock.c lsm,selinux: pass flowi_common instead of flowi to the LSM hooks 2020-11-23 18:36:21 -05:00
inet6_hashtables.c net: remove duplicate reuseport_lookup functions 2024-06-16 13:39:21 +02:00
ioam6.c ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() 2026-03-04 07:20:36 -05:00
ioam6_iptunnel.c ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() 2026-03-04 07:20:36 -05:00
ip6_checksum.c net: udp: fix handling of CHECKSUM_COMPLETE packets 2018-10-24 14:18:16 -07:00
ip6_fib.c ipv6: fix possible race in __fib6_drop_pcpu_from() 2024-07-05 09:14:09 +02:00
ip6_flowlabel.c net: ipv6: flowlabel: defer exclusive option free until RCU teardown 2026-04-18 10:33:30 +02:00
ip6_gre.c ip6_gre: make ip6gre_header() robust 2026-01-19 13:09:56 +01:00
ip6_icmp.c icmp: fix icmp_ndo_send address translation for reply direction 2025-09-09 18:50:18 +02:00
ip6_input.c ipv6: annotate data-races around cnf.disable_ipv6 2024-07-18 13:07:43 +02:00
ip6_offload.c ipv6: reject malicious packets in ipv6_gso_segment() 2025-08-28 16:24:13 +02:00
ip6_offload.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ip6_output.c ipv6: Fix potential uninit-value access in __ip6_make_skb() 2026-01-19 13:10:12 +01:00
ip6_tunnel.c ip6_tunnel: clear skb2->cb[] in ip4ip6_err() 2026-04-18 10:33:29 +02:00
ip6_udp_tunnel.c net: Make locking in sock_bindtoindex optional 2020-06-01 14:57:14 -07:00
ip6_vti.c ip6_vti: fix slab-use-after-free in decode_session6 2023-08-26 14:23:32 +02:00
ip6mr.c ip6mr: Fix skb_under_panic in ip6mr_cache_report() 2023-08-11 15:13:53 +02:00
ipcomp6.c xfrm: delete x->tunnel as we delete x 2026-01-19 13:09:18 +01:00
ipv6_sockglue.c tcp: Fix data races around icsk->icsk_af_ops. 2024-07-05 09:14:51 +02:00
Kconfig net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL 2024-10-17 15:11:08 +02:00
Makefile ipv6: ioam: Support for IOAM injection with lwtunnels 2021-07-21 08:14:33 -07:00
mcast.c ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). 2025-08-28 16:24:21 +02:00
mcast_snoop.c net: bridge: mcast: fix broken length + header check for MRDv6 Adv. 2021-04-27 14:02:06 -07:00
mip6.c xfrm: ipv6: move mip6_rthdr_offset into xfrm core 2021-06-11 14:48:50 +02:00
ndisc.c net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak 2026-04-18 10:33:29 +02:00
netfilter.c netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it 2025-06-27 11:05:12 +01:00
output_core.c ipv6: use prandom_u32() for ID generation 2021-05-31 22:12:08 -07:00
ping.c ping6: Fix send to link-local addresses with VRF. 2023-06-21 15:59:16 +02:00
proc.c minmax: add a few more MIN_T/MAX_T users 2025-10-19 16:21:52 +02:00
protocol.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
raw.c ipv6: np->rxpmtu race annotation 2025-12-07 06:09:22 +09:00
reassembly.c net: ipv6: fix wrong start position when receive hop-by-hop fragment 2024-06-16 13:39:25 +02:00
route.c net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop 2026-04-18 10:33:10 +02:00
rpl.c net: rpl: fix rpl header size calculation 2023-04-26 13:51:49 +02:00
rpl_iptunnel.c rpl: Fix use-after-free in rpl_do_srh_inline(). 2025-08-28 16:24:01 +02:00
seg6.c ipv6: sr: fix invalid unregister error path 2024-06-16 13:39:26 +02:00
seg6_hmac.c ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add 2025-08-28 16:24:38 +02:00
seg6_iptunnel.c seg6: separate dst_cache for input and output paths in seg6 lwtunnel 2026-04-18 10:33:37 +02:00
seg6_local.c seg6: Fix validation of nexthop addresses 2025-06-27 11:05:18 +01:00
sit.c sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() 2023-05-17 11:50:16 +02:00
syncookies.c dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2023-11-20 11:08:28 +01:00
sysctl_net_ipv6.c ipv6: ioam: Data plane support for Pre-allocated Trace 2021-07-21 08:14:33 -07:00
tcp_ipv6.c net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
tcpv6_offload.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
tunnel6.c tunnel6: add tunnel6_input_afinfo for ipip and ipv6 tunnels 2020-07-09 12:52:37 +02:00
udp.c ipv6: np->rxpmtu race annotation 2025-12-07 06:09:22 +09:00
udp_impl.h tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). 2023-04-26 13:51:54 +02:00
udp_offload.c gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers 2024-09-12 11:07:47 +02:00
udplite.c udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). 2023-05-30 13:55:31 +01:00
xfrm6_input.c xfrm: Preserve vlan tags for transport mode software GRO 2024-05-17 11:50:57 +02:00
xfrm6_output.c xfrm: Fix the usage of skb->sk 2026-04-18 10:33:24 +02:00
xfrm6_policy.c xfrm6: fix uninitialized saddr in xfrm6_get_saddr() 2026-03-04 07:20:21 -05:00
xfrm6_protocol.c xfrm: add support for UDPv6 encapsulation of ESP 2020-04-28 11:28:36 +02:00
xfrm6_state.c xfrm: remove output_finish indirection from xfrm_state_afinfo 2020-05-06 09:40:08 +02:00
xfrm6_tunnel.c xfrm: flush all states in xfrm_state_fini 2026-01-19 13:09:19 +01:00