kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net/ipv6
History
Dave Jones 30efc09c28 netfilter: ensure number of counters is >0 in do_replace() 
commit 1086bbe97a upstream.

After improving setsockopt() coverage in trinity, I started triggering
vmalloc failures pretty reliably from this code path:

warn_alloc_failed+0xe9/0x140
__vmalloc_node_range+0x1be/0x270
vzalloc+0x4b/0x50
__do_replace+0x52/0x260 [ip_tables]
do_ipt_set_ctl+0x15d/0x1d0 [ip_tables]
nf_setsockopt+0x65/0x90
ip_setsockopt+0x61/0xa0
raw_setsockopt+0x16/0x60
sock_common_setsockopt+0x14/0x20
SyS_setsockopt+0x71/0xd0

It turns out we don't validate that the num_counters field in the
struct we pass in from userspace is initialized.

The same problem also exists in ebtables, arptables, ipv6, and the
compat variants.

Signed-off-by: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2016-08-22 22:38:31 +01:00
..
netfilter netfilter: ensure number of counters is >0 in do_replace() 2016-08-22 22:38:31 +01:00
addrconf.c ipv6, token: allow for clearing the current device token 2016-08-22 22:37:50 +01:00
addrconf_core.c ipv6: remove rt6i_genid 2014-10-15 12:05:29 +02:00
addrlabel.c ipv6/addrlabel: fix ip6addrlbl_get() 2016-01-25 10:44:00 +00:00
af_inet6.c net: add validation for the socket syscall protocol argument 2016-01-04 17:20:45 +00:00
ah6.c ah6: Use the IPsec protocol multiplexer API 2014-03-14 07:28:07 +01:00
anycast.c ipv6: restore the behavior of ipv6_sock_ac_drop() 2014-10-15 12:05:28 +02:00
datagram.c ipv6/udp: use sticky pktinfo egress ifindex on connect() 2016-03-09 10:38:49 +00:00
esp6.c esp6: Use the IPsec protocol multiplexer API 2014-03-14 07:28:07 +01:00
exthdrs.c ipv6: add complete rcu protection around np->opt 2015-12-18 16:06:24 +00:00
exthdrs_core.c ipv6: re-enable fragment header matching in ipv6_find_hdr 2016-03-24 10:01:14 +00:00
exthdrs_offload.c ipv6: fix exthdrs offload registration in out_rt path 2015-09-30 13:20:50 +01:00
fib6_rules.c ipv6: fix backtracking for throw routes 2015-03-24 10:34:13 +00:00
icmp.c ipv6: fix endianness error in icmpv6_err 2016-08-22 22:38:15 +01:00
inet6_connection_sock.c ipv6: add complete rcu protection around np->opt 2015-12-18 16:06:24 +00:00
inet6_hashtables.c inet: convert inet_ehash_secret and ipv6_hash_secret to net_get_random_once 2013-10-19 19:45:35 -04:00
ip6_checksum.c udp: Generic functions to set checksum 2014-06-04 22:46:38 -07:00
ip6_fib.c ipv6: fix ECMP route replacement 2015-06-02 13:02:14 +01:00
ip6_flowlabel.c ipv6: fix a lockdep splat 2016-02-25 10:51:01 +00:00
ip6_gre.c gre6: allow to update all parameters via rtnl 2016-01-04 17:20:42 +00:00
ip6_icmp.c ipv6: Kill ipv6 dependency of icmpv6_send(). 2013-04-29 13:54:36 -04:00
ip6_input.c ipv6: Make MLD packets to only be processed locally 2015-08-10 17:10:15 +01:00
ip6_offload.c net: gso: use feature flag argument in all protocol gso handlers 2015-08-27 14:27:14 +01:00
ip6_offload.h ipv6: Pull IPv6 GSO registration out of the module 2012-11-15 17:39:24 -05:00
ip6_output.c ipv6: Count in extension headers in skb->network_header 2016-05-01 00:06:15 +02:00
ip6_tunnel.c ip6_tunnel: set rtnl_link_ops before calling register_netdevice 2016-05-01 00:06:08 +02:00
ip6_vti.c vti6: fix uninit when using x-netns 2015-05-06 11:33:05 +01:00
ip6mr.c ip6mr: call del_timer_sync() in ip6mr_free_table() 2016-01-04 17:20:48 +00:00
ipcomp6.c ipcomp6: Use the IPsec protocol multiplexer API 2014-03-14 07:28:07 +01:00
ipv6_sockglue.c ipv6: add complete rcu protection around np->opt 2015-12-18 16:06:24 +00:00
Kconfig ip6_vti: Fix build when NET_IP_TUNNEL is not set. 2014-02-20 14:29:49 +01:00
Makefile xfrm6: Add IPsec protocol multiplexer 2014-03-14 07:28:07 +01:00
mcast.c mld, igmp: Fix reserved tailroom calculation 2016-03-24 10:01:13 +00:00
mip6.c ipv4/ipv6: Fix FSF address in file headers 2013-12-06 12:37:56 -05:00
ndisc.c net/ipv6: add sysctl option accept_ra_min_hop_limit 2016-03-24 09:59:05 +00:00
netfilter.c netfilter: Fix potential use after free in ip6_route_me_harder() 2014-05-09 02:36:39 +02:00
output_core.c drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO packets 2014-12-10 17:49:35 +00:00
ping.c net: ping: Return EAFNOSUPPORT when appropriate. 2015-03-12 16:45:17 +00:00
proc.c snmp: fix some left over of snmp stats 2014-05-14 15:33:47 -04:00
protocol.c net: remove outdated comment for ipv4 and ipv6 protocol handler 2013-11-28 18:47:51 -05:00
raw.c Revert "[stable-only] net: add length argument to skb_copy_and_csum_datagram_iovec" 2016-01-25 10:44:07 +00:00
reassembly.c ipv6: distinguish frag queues by device for multicast and link-local packets 2015-12-18 16:06:23 +00:00
route.c ipv6: fix ECMP route replacement 2015-06-02 13:02:14 +01:00
sit.c sit: fix sit0 percpu double allocations 2015-12-09 11:40:54 +00:00
syncookies.c ipv6: add complete rcu protection around np->opt 2015-12-18 16:06:24 +00:00
sysctl_net_ipv6.c net: add a sysctl to reflect the fwmark on replies 2014-05-13 18:35:08 -04:00
tcp_ipv6.c tcp: record TLP and ER timer stats in v6 stats 2016-08-22 22:38:09 +01:00
tcpv6_offload.c net-gre-gro: Fix a bug that breaks the forwarding path 2014-07-16 14:45:26 -07:00
tunnel6.c ipv6: fix tunnel error handling 2015-12-13 17:49:43 +00:00
udp.c udp6: fix UDP/IPv6 encap resubmit path 2016-05-01 00:06:13 +02:00
udp_impl.h net: ipv4/ipv6: Remove extern from function prototypes 2013-10-19 19:12:11 -04:00
udp_offload.c gre: Call gso_make_checksum 2014-06-04 22:46:38 -07:00
udplite.c net: Eliminate no_check from protosw 2014-05-23 16:28:53 -04:00
xfrm6_input.c netfilter: ipv6: use NFPROTO values for NF_HOOK invocation 2010-03-25 16:00:49 +01:00
xfrm6_mode_beet.c ipsec: be careful of non existing mac headers 2012-02-23 16:50:45 -05:00
xfrm6_mode_ro.c ipv4/ipv6: Fix FSF address in file headers 2013-12-06 12:37:56 -05:00
xfrm6_mode_transport.c [IPSEC]: Use IPv6 calling convention as the convention for x->mode->output 2007-10-10 16:55:54 -07:00
xfrm6_mode_tunnel.c ipv6: update skb->csum when CE mark is propagated 2016-01-28 11:06:06 +00:00
xfrm6_output.c ipv6: Fix IPsec pre-encap fragmentation check 2015-11-16 11:27:17 +00:00
xfrm6_policy.c xfrm: dst_entries_init() per-net dst_ops 2016-01-28 11:57:51 +00:00
xfrm6_protocol.c xfrm6: Properly handle unsupported protocols 2014-05-06 07:08:38 +02:00
xfrm6_state.c xfrm: make local error reporting more robust 2013-08-14 13:07:12 +02:00
xfrm6_tunnel.c ipv4/ipv6: Fix FSF address in file headers 2013-12-06 12:37:56 -05:00