Tom Parkin 13cd1daeea l2tp: pass correct message length to ip6_append_data ... commit 359e54a93a upstream. l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff. To manage this, we check whether the skbuff contains data using skb_queue_empty when deciding how much data to append using ip6_append_data. However, the code which performed the calculation was incorrect: ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0; ...due to C operator precedence, this ends up setting ulen to transhdrlen for messages with a non-zero length, which results in corrupted packets on the wire. Add parentheses to correct the calculation in line with the original intent. Fixes: 9d4c75800f ("ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()") Cc: David Howells <dhowells@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Tom Parkin <tparkin@katalix.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20240220122156.43131-1-tparkin@katalix.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-03-01 13:26:33 +01:00
..
6lowpan
9p	net: 9p: avoid freeing uninit memory in p9pdu_vreadf	2024-01-01 12:39:04 +00:00
802
8021q	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING	2024-01-31 16:17:04 -08:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 17:00:19 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 17:00:17 +01:00
ax25
batman-adv	net: vlan: introduce skb_vlan_eth_hdr()	2023-12-20 17:00:16 +01:00
bluetooth	Bluetooth: L2CAP: Fix possible multiple reject send	2024-02-05 20:12:53 +00:00
bpf
bpfilter
bridge	bridge: mcast: fix disabled snooping after long uptime	2024-02-05 20:13:01 +00:00
caif
can	can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)	2024-02-23 09:12:47 +01:00
ceph	libceph: use kernel_connect()	2023-10-19 23:08:56 +02:00
core	net: prevent mss overflow in skb_segment()	2024-02-23 09:12:51 +01:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-11 12:08:17 +02:00
dccp	dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.	2023-11-20 11:52:16 +01:00
devlink	devlink: remove reload failed checks in params get/set callbacks	2023-09-23 11:11:01 +02:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 15:27:38 -08:00
dsa	net: dsa: sja1105: always enable the send_meta options	2023-07-19 16:22:06 +02:00
ethernet
ethtool	ethtool: netlink: Add missing ethnl_ops_begin/complete	2024-01-25 15:27:51 -08:00
hsr	net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()	2024-02-23 09:12:37 +01:00
ieee802154
ife	net: sched: ife: fix potential use-after-free	2024-01-01 12:38:56 +00:00
ipv4	inet: read sk->sk_family once in inet_recv_error()	2024-02-16 19:06:27 +01:00
ipv6	ipv6: Ensure natural alignment of const ipv6 loopback and router addresses	2024-02-05 20:13:01 +00:00
iucv
kcm	kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().	2023-09-19 12:28:10 +02:00
key	net: af_key: fix sadb_x_filter validation	2023-08-23 17:52:32 +02:00
l2tp	l2tp: pass correct message length to ip6_append_data	2024-03-01 13:26:33 +01:00
l3mdev
lapb
llc	llc: call sock_orphan() at release time	2024-02-05 20:13:01 +00:00
mac80211	wifi: mac80211: adding missing drv_mgd_complete_tx() call	2024-03-01 13:26:29 +01:00
mac802154
mctp	mctp: perform route lookups under a RCU read-side lock	2023-10-19 23:08:57 +02:00
mpls
mptcp	mptcp: check addrs list in userspace_pm_get_local_id	2024-02-23 09:12:36 +01:00
ncsi	net/ncsi: Fix netlink major/minor version numbers	2024-01-25 15:27:24 -08:00
netfilter	netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new	2024-03-01 13:26:27 +01:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 15:27:20 -08:00
netlink	netlink: fix potential sleeping issue in mqueue_flush_file	2024-01-31 16:17:05 -08:00
netrom	netrom: Deny concurrent connect().	2023-09-13 09:42:35 +02:00
nfc	nfc: nci: free rx_data_reassembly skb on NCI device cleanup	2024-02-23 09:12:37 +01:00
nsh	net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()	2023-05-24 17:32:45 +01:00
openvswitch	net: openvswitch: limit the number of recursions from action sets	2024-02-23 09:12:30 +01:00
packet	packet: Move reference count in packet_sock to atomic_long_t	2023-12-13 18:39:20 +01:00
phonet
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:39:11 +01:00
qrtr	net: qrtr: ns: Return 0 if server port is not present	2024-01-20 11:50:09 +01:00
rds	net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv	2024-01-31 16:17:04 -08:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-01 12:39:04 +00:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-01 12:38:57 +00:00
rxrpc	rxrpc: Fix response to PING RESPONSE ACKs to a dead call	2024-02-16 19:06:27 +01:00
sched	net/sched: Retire dsmark qdisc	2024-03-01 13:26:24 +01:00
sctp	sctp: fix busy polling	2024-01-25 15:27:30 -08:00
smc	net/smc: disable SEID on non-s390 archs where virtual ISM may be used	2024-02-05 20:12:54 +00:00
strparser
sunrpc	SUNRPC: Fix a suspicious RCU usage warning	2024-02-05 20:12:49 +00:00
switchdev
tipc	tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()	2024-02-16 19:06:27 +01:00
tls	tls: fix NULL deref on tls_sw_splice_eof() with empty record	2024-02-23 09:12:48 +01:00
unix	af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.	2024-02-16 19:06:27 +01:00
vmw_vsock	virtio/vsock: fix logic which reduces credit update messages	2024-01-25 15:27:28 -08:00
wireless	wifi: cfg80211: fix missing interfaces when dumping	2024-03-01 13:26:25 +01:00
x25
xdp	xsk: Skip polling event check for unbound socket	2023-12-13 18:39:08 +01:00
xfrm	xfrm: Silence warnings triggerable by bad packets	2024-02-23 09:12:47 +01:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile	devlink: move code to a dedicated directory	2023-08-30 16:11:00 +02:00
socket.c	splice, net: Add a splice_eof op to file-ops and socket-ops	2024-01-10 17:10:27 +01:00
sysctl_net.c