linux-stable/net/ipv4
Shreyansh Chouhan 99279223a3 ip_gre: add validation for csum_start
[ Upstream commit 1d011c4803 ]

Validate csum_start in gre_handle_offloads before we call _gre_xmit so
that we do not crash later when the csum_start value is used in the
lco_csum function call.

This patch deals with ipv4 code.

Fixes: c544193214 ("GRE: Refactor GRE tunneling code.")
Reported-by: syzbot+ff8e1b9f2f36481e2efc@syzkaller.appspotmail.com
Signed-off-by: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-03 09:56:25 +02:00
..
netfilter netfilter: x_tables: fix compat match/target pad out-of-bound write 2021-04-16 11:57:53 +02:00
af_inet.c gso_segment: Reset skb->mac_len after modifying network header 2018-09-29 03:06:00 -07:00
ah4.c
arp.c arp: fix arp_filter on l3slave devices 2018-04-12 12:32:22 +02:00
cipso_ipv4.c net: ipv4: fix memory leak in netlbl_cipsov4_add_std 2021-06-30 08:48:49 -04:00
datagram.c inet: stop leaking jiffies on the wire 2019-11-10 11:25:37 +01:00
devinet.c devinet: fix memleak in inetdev_init() 2020-06-11 09:22:58 +02:00
esp4.c esp: avoid unneeded kmap_atomic call 2021-01-23 15:48:46 +01:00
esp4_offload.c esp: Fix GRO when the headers not fully in the linear part of the skb. 2018-02-25 11:07:46 +01:00
fib_frontend.c ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() 2021-01-12 20:09:08 +01:00
fib_lookup.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fib_notifier.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fib_rules.c
fib_semantics.c net: Fix the arp error in some cases 2020-06-30 15:38:00 -04:00
fib_trie.c ipv4: Silence suspicious RCU usage warning 2020-08-21 09:48:00 +02:00
fou.c net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv 2019-04-27 09:35:34 +02:00
gre_demux.c gre: fix uninit-value in __iptunnel_pull_header 2020-03-20 10:54:07 +01:00
gre_offload.c net: gre: recompute gre csum for sctp over gre tunnels 2020-08-21 09:48:01 +02:00
icmp.c icmp: don't send out ICMP messages with a source address of 0.0.0.0 2021-06-30 08:48:51 -04:00
igmp.c net: ipv4: fix memory leak in ip_mc_add1_src 2021-06-30 08:48:51 -04:00
inet_connection_sock.c net: refactor bind_bucket fastreuse into helper 2020-08-21 09:48:14 +02:00
inet_diag.c inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() 2020-11-24 13:05:37 +01:00
inet_fragment.c net: IP defrag: encapsulate rbtree defrag code into callable functions 2019-04-27 09:35:40 +02:00
inet_hashtables.c net: initialize fastreuse on inet_inherit_port 2020-08-21 09:48:16 +02:00
inet_timewait_sock.c soreuseport: initialise timewait reuseport field 2018-05-16 10:10:24 +02:00
inetpeer.c inetpeer: fix data-race in inet_putpeer / inet_putpeer 2020-01-04 14:00:07 +01:00
ip_forward.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ip_fragment.c net: IP defrag: encapsulate rbtree defrag code into callable functions 2019-04-27 09:35:40 +02:00
ip_gre.c ip_gre: add validation for csum_start 2021-09-03 09:56:25 +02:00
ip_input.c vrf: check accept_source_route on the original netdevice 2019-04-17 08:37:48 +02:00
ip_options.c vrf: check accept_source_route on the original netdevice 2019-04-17 08:37:48 +02:00
ip_output.c net: ip: always refragment ip defragmented packets 2021-01-17 13:58:58 +01:00
ip_sockglue.c ip: on queued skb use skb_header_pointer instead of pskb_may_pull 2019-01-23 08:09:47 +01:00
ip_tunnel.c net: fix pmtu check in nopmtudisc mode 2021-01-17 13:58:58 +01:00
ip_tunnel_core.c ip_tunnel: allow not to count pkts on tstats by setting skb's dev to NULL 2019-08-04 09:32:03 +02:00
ip_vti.c ip_vti: receive ipip packet by calling ip_tunnel_rcv 2020-06-03 08:18:08 +02:00
ipcomp.c
ipconfig.c net: ipconfig: Don't override command-line hostnames or domains 2021-06-30 08:48:47 -04:00
ipip.c net: ipip: fix wrong address family in init error path 2020-06-03 08:17:31 +02:00
ipmr.c ipv4: Fix potential Spectre v1 vulnerability 2019-01-09 17:14:42 +01:00
Kconfig vti[6]: fix packet tx through bpf_redirect() in XinY cases 2020-04-02 16:34:32 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
netfilter.c
ping.c ping: Check return value of function 'ping_queue_rcv_skb' 2021-06-30 08:48:57 -04:00
proc.c tcp: tcp_fragment() should apply sane memory limits 2019-06-17 19:52:44 +02:00
protocol.c
raw.c net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg() 2020-05-02 17:24:11 +02:00
raw_diag.c inet_diag: return classid for all socket types 2020-03-20 10:54:13 +01:00
route.c inet: use bigger hash table for IP ID generation 2021-06-30 08:48:55 -04:00
syncookies.c net: Update window_clamp if SOCK_RCVBUF is set 2020-11-18 18:28:00 +01:00
sysctl_net_ipv4.c tcp: add tcp_min_snd_mss sysctl 2019-06-17 19:52:44 +02:00
tcp.c tcp: make sure listeners don't initialize congestion-control state 2020-07-22 09:22:20 +02:00
tcp_bbr.c tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets 2021-08-26 08:37:02 -04:00
tcp_bic.c
tcp_cdg.c
tcp_cong.c tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control 2020-12-08 10:17:33 +01:00
tcp_cubic.c tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT 2020-06-30 15:37:59 -04:00
tcp_dctcp.c tcp: Ensure DCTCP reacts to losses 2019-04-17 08:37:47 +02:00
tcp_diag.c tcp_diag: report TCP MD5 signing keys and addresses 2017-09-01 18:38:09 -07:00
tcp_fastopen.c net: add rb_to_skb() and other rb tree helpers 2018-09-19 22:43:47 +02:00
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c net/tcp/illinois: replace broken algorithm reference link 2018-05-30 07:52:06 +02:00
tcp_input.c tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN 2021-02-03 23:22:23 +01:00
tcp_ipv4.c tcp: annotate data races around tp->mtu_info 2021-07-28 11:12:16 +02:00
tcp_lp.c
tcp_metrics.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tcp_minisocks.c tcp: do not restart timewait timer on rst reception 2018-09-15 09:45:25 +02:00
tcp_nv.c tcp_nv: fix potential integer overflow in tcpnv_acked 2018-04-26 11:02:13 +02:00
tcp_offload.c gso: validate gso_type in GSO handlers 2018-01-31 14:03:47 +01:00
tcp_output.c ipv6: tcp: drop silly ICMPv6 packet too big messages 2021-07-28 11:12:16 +02:00
tcp_probe.c
tcp_rate.c tcp: invalidate rate samples during SACK reneging 2018-01-02 20:31:09 +01:00
tcp_recovery.c tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN 2021-02-03 23:22:23 +01:00
tcp_scalable.c
tcp_timer.c tcp: exit if nothing to retransmit on RTO timeout 2019-12-17 20:38:43 +01:00
tcp_ulp.c tcp, ulp: add alias for all ulp modules 2018-09-15 09:45:29 +02:00
tcp_vegas.c tcp: fix under-evaluated ssthresh in TCP Vegas 2017-12-25 14:26:30 +01:00
tcp_vegas.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tcp_veno.c
tcp_westwood.c
tcp_yeah.c
tunnel4.c
udp.c udp: fix race between close() and udp_abort() 2021-06-30 08:48:49 -04:00
udp_diag.c inet_diag: return classid for all socket types 2020-03-20 10:54:13 +01:00
udp_impl.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
udp_offload.c net: Fix gro aggregation for udp encaps with zero csum 2021-03-17 16:34:28 +01:00
udp_tunnel.c
udplite.c
xfrm4_input.c xfrm: reset transport header back to network header after all input transforms ahave been applied 2018-11-04 14:52:37 +01:00
xfrm4_mode_beet.c
xfrm4_mode_transport.c xfrm: reset transport header back to network header after all input transforms ahave been applied 2018-11-04 14:52:37 +01:00
xfrm4_mode_tunnel.c
xfrm4_output.c xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish 2020-05-02 17:24:18 +02:00
xfrm4_policy.c net: add bool confirm_neigh parameter for dst_ops.update_pmtu 2020-01-04 14:00:14 +01:00
xfrm4_protocol.c
xfrm4_state.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
xfrm4_tunnel.c