Files
linux/include/net
Willem de Bruijn cb9f1b7838 ip: validate header length on virtual device xmit
KMSAN detected read beyond end of buffer in vti and sit devices when
passing truncated packets with PF_PACKET. The issue affects additional
ip tunnel devices.

Extend commit 76c0ddd8c3 ("ip6_tunnel: be careful when accessing the
inner header") and commit ccfec9e5cb ("ip_tunnel: be careful when
accessing the inner header").

Move the check to a separate helper and call at the start of each
ndo_start_xmit function in net/ipv4 and net/ipv6.

Minor changes:
- convert dev_kfree_skb to kfree_skb on error path,
  as dev_kfree_skb calls consume_skb which is not for error paths.
- use pskb_network_may_pull even though that is pedantic here,
  as the same as pskb_may_pull for devices without llheaders.
- do not cache ipv6 hdrs if used only once
  (unsafe across pskb_may_pull, was more relevant to earlier patch)

Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-01-01 12:05:02 -08:00
..
2018-09-08 01:39:47 +09:00
2018-01-19 14:02:12 -05:00
2018-09-18 19:55:01 -07:00
2018-12-10 15:54:34 -08:00
2018-11-15 11:35:40 -08:00
2018-10-31 12:37:12 -07:00
2018-05-16 07:23:35 +02:00
2018-09-26 20:22:19 -07:00
2018-07-30 09:10:25 -07:00
2018-02-28 11:43:28 -05:00
2018-04-23 10:21:24 -04:00
2018-11-07 23:00:23 -08:00
2017-12-11 14:10:06 -05:00
2018-11-07 16:23:05 -08:00
2018-09-13 09:04:58 -07:00
2018-04-07 22:32:31 -04:00
2017-11-08 16:12:33 +09:00
2018-09-25 20:17:35 -07:00
2017-12-05 14:37:13 -05:00
2018-05-16 07:23:35 +02:00
2018-06-22 13:43:27 +09:00
2018-12-20 16:56:04 -08:00
2019-01-01 09:47:59 -08:00
2018-12-07 12:59:08 -08:00
2018-08-29 12:25:53 -07:00