linux-stable/net
Wang Yufen 034246122f ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
[ Upstream commit f638a84afe ]

When len >= INT_MAX - transhdrlen, ulen = len + transhdrlen will be
overflow. To fix, we can follow what udpv6 does and subtract the
transhdrlen from the max.

Signed-off-by: Wang Yufen <wangyufen@huawei.com>
Link: https://lore.kernel.org/r/20220607120028.845916-2-wangyufen@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-06-22 14:27:54 +02:00
..
6lowpan net: don't include ndisc.h from ipv6.h 2022-02-04 14:15:11 -08:00
9p xen/grant-table: remove readonly parameter from functions 2022-03-15 20:34:40 -05:00
802
8021q vlan: use correct format characters 2022-03-17 16:34:49 -07:00
appletalk
atm proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
ax25 ax25: Fix ax25 session cleanup problems 2022-06-14 18:44:59 +02:00
batman-adv batman-adv: Don't skb_split skbuffs with frag_list 2022-04-17 23:41:44 +02:00
bluetooth bluetooth: don't use bitmaps for random flag accesses 2022-06-14 18:45:01 +02:00
bpf bpf: Fix release of page_pool in BPF_PROG_RUN in test runner 2022-04-11 17:30:15 +02:00
bpfilter uaccess: remove CONFIG_SET_FS 2022-02-25 09:36:06 +01:00
bridge net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. 2022-05-19 09:20:44 +02:00
caif net: caif: Use netif_rx(). 2022-03-04 12:02:19 +00:00
can can: isotp: remove re-binding of bound socket 2022-04-29 11:02:47 +02:00
ceph libceph: fix misleading ceph_osdc_cancel_request() comment 2022-05-18 21:21:29 +02:00
core net, neigh: Set lower cap for neigh_managed_work rearming 2022-06-14 18:45:12 +02:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-03 08:01:55 -08:00
dccp Revert "tcp/dccp: get rid of inet_twsk_purge()" 2022-05-13 12:24:12 +01:00
decnet decnet: Use container_of() for struct dn_neigh casts 2022-05-10 12:21:51 +02:00
dns_resolver
dsa net: dsa: flush switchdev workqueue on bridge join error path 2022-05-09 18:08:04 -07:00
ethernet
ethtool ethtool: add support to set/get completion queue event size 2022-02-23 20:33:05 -08:00
hsr net: add per-cpu storage and net->core_stats 2022-03-11 23:17:24 -08:00
ieee802154 net: ipv6: Handle delivery_time in ipv6 defrag 2022-03-03 14:38:48 +00:00
ife
ipv4 tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd 2022-06-14 18:45:21 +02:00
ipv6 ipv6: Fix signed integer overflow in __ip6_append_data 2022-06-22 14:27:54 +02:00
iucv s390/iucv: sort out physical vs virtual pointers usage 2022-02-22 16:09:13 -08:00
kcm
key Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" 2022-06-14 18:45:12 +02:00
l2tp ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg 2022-06-22 14:27:54 +02:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-15 14:27:24 -07:00
lapb
llc llc: only change llc->dev when bind() succeeds 2022-03-25 16:55:41 -07:00
mac80211 mac80211: upgrade passive scan to active scan on DFS channels after beacon rx 2022-06-09 10:30:50 +02:00
mac802154
mctp mctp: defer the kfree of object mdev->addrs 2022-04-26 09:14:47 +02:00
mpls net: mpls: Fix GCC 12 warning 2022-02-10 15:29:39 +00:00
mptcp mptcp: reset the packet scheduler on PRIO change 2022-06-09 10:29:57 +02:00
ncsi all: replace find_next{,_zero}_bit with find_first{,_zero}_bit where appropriate 2022-01-15 08:47:31 -08:00
netfilter netfilter: nf_tables: bail out early if hardware offload is not supported 2022-06-14 18:45:05 +02:00
netlabel netlabel: fix out-of-bounds memory accesses 2022-03-21 10:59:11 +00:00
netlink netlink: do not reset transport header in netlink_recvmsg() 2022-05-06 15:37:36 -07:00
netrom netrom: fix api breakage in nr_setsockopt() 2022-01-07 14:11:05 +00:00
nfc NFC: NULL out the dev->rfkill to prevent UAF 2022-06-09 10:29:58 +02:00
nsh
openvswitch net: openvswitch: fix misuse of the cached connection on tuple changes 2022-06-14 18:45:18 +02:00
packet net/packet: fix packet_sock xmit return value checking 2022-04-15 11:17:30 +01:00
phonet phonet: Use netif_rx(). 2022-03-07 11:40:41 +00:00
psample
qrtr
rds net: rds: use maybe_get_net() when acquiring refcount on TCP sockets 2022-05-05 16:44:49 -07:00
rfkill rfkill: make new event layout opt-in 2022-03-18 13:09:17 +02:00
rose
rxrpc rxrpc: Fix decision on when to generate an IDLE ACK 2022-06-09 10:30:20 +02:00
sched net/sched: act_api: fix error code in tcf_ct_flow_table_fill_tuple_ipv6() 2022-06-14 18:44:59 +02:00
sctp sctp: read sk->sk_bound_dev_if once in sctp_rcv() 2022-06-09 10:30:14 +02:00
smc net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *" 2022-06-14 18:44:56 +02:00
strparser
sunrpc SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() 2022-06-14 18:45:06 +02:00
switchdev net: switchdev: remove lag_mod_cb from switchdev_handle_fdb_event_to_device 2022-02-24 21:31:43 -08:00
tipc tipc: check attribute length for bearer name 2022-06-14 18:45:00 +02:00
tls tls: Fix context leak on tls_device_down 2022-05-12 10:01:36 -07:00
unix af_unix: Fix a data-race in unix_dgram_peer_wake_me(). 2022-06-14 18:45:05 +02:00
vmw_vsock vsock/virtio: enable VQs early on probe 2022-03-24 18:36:36 -07:00
wireless cfg80211: declare MODULE_FIRMWARE for regulatory.db 2022-06-09 10:30:50 +02:00
x25 net/x25: Fix null-ptr-deref caused by x25_disconnect 2022-03-26 11:48:16 -07:00
xdp xsk: Fix handling of invalid descriptors in XSK TX batching API 2022-06-14 18:45:06 +02:00
xfrm xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown 2022-05-17 11:02:07 +02:00
Kconfig page_pool: Add allocation stats 2022-03-03 09:55:28 +00:00
Kconfig.debug
Makefile
compat.c
devres.c
socket.c fs: allocate inode by using alloc_inode_sb() 2022-03-22 15:57:03 -07:00
sysctl_net.c