mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/net
History
Tom Parkin 359e54a93a l2tp: pass correct message length to ip6_append_data 
l2tp_ip6_sendmsg needs to avoid accounting for the transport header
twice when splicing more data into an already partially-occupied skbuff.

To manage this, we check whether the skbuff contains data using
skb_queue_empty when deciding how much data to append using
ip6_append_data.

However, the code which performed the calculation was incorrect:

     ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0;

...due to C operator precedence, this ends up setting ulen to
transhdrlen for messages with a non-zero length, which results in
corrupted packets on the wire.

Add parentheses to correct the calculation in line with the original
intent.

Fixes: 9d4c75800f ("ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()")
Cc: David Howells <dhowells@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Tom Parkin <tparkin@katalix.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240220122156.43131-1-tparkin@katalix.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		2024-02-22 10:42:17 +01:00
..
6lowpan net: fill in MODULE_DESCRIPTION()s for 6LoWPAN 2024-02-09 14:12:01 -08:00
9p net: 9p: avoid freeing uninit memory in p9pdu_vreadf 2023-12-13 05:44:30 +09:00
802 net: fill in MODULE_DESCRIPTION()s under net/802* 2023-10-28 11:29:28 +01:00
8021q vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING 2024-01-19 21:25:06 -08:00
appletalk net: remove SOCK_DEBUG leftovers 2023-12-26 20:31:01 +00:00
atm net: fill in MODULE_DESCRIPTION()s for mpoa 2024-02-09 14:12:01 -08:00
ax25 net: implement lockless SO_PRIORITY 2023-10-01 19:09:54 +01:00
batman-adv batman-adv: mcast: fix memory leak on deleting a batman-adv interface 2024-01-27 09:13:39 +01:00
bluetooth TTY/Serial changes for 6.8-rc1 2024-01-18 11:37:24 -08:00
bpf bpf: Fix dtor CFI 2023-12-15 16:25:55 -08:00
bridge net: bridge: switchdev: Ensure deferred event delivery on unoffload 2024-02-16 09:36:37 +00:00
caif net: fill in MODULE_DESCRIPTION()s for CAIF 2024-01-05 08:06:35 -08:00
can can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) 2024-02-14 13:53:03 +01:00
ceph libceph: just wait for more data to be available on the socket 2024-02-07 14:43:29 +01:00
core bpf-for-netdev 2024-02-22 10:04:47 +01:00
dcb
…
dccp net: remove SOCK_DEBUG leftovers 2023-12-26 20:31:01 +00:00
devlink devlink: fix port dump cmd type 2024-02-21 17:11:04 -08:00
dns_resolver Networking changes for 6.8. 2024-01-11 10:07:29 -08:00
dsa net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events 2024-01-11 16:33:52 -08:00
ethernet
…
ethtool ethtool: netlink: Add missing ethnl_ops_begin/complete 2024-01-18 13:21:06 +01:00
handshake net/handshake: Fix handshake_req_destroy_test1 2024-02-08 18:32:29 -08:00
hsr net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() 2024-01-29 11:29:55 +00:00
ieee802154 mac802154: Avoid new associations while disassociating 2023-12-15 11:14:57 +01:00
ife net: sched: ife: fix potential use-after-free 2023-12-15 10:50:18 +00:00
ipv4 net: implement lockless setsockopt(SO_PEEK_OFF) 2024-02-21 11:24:20 +00:00
ipv6 Fix write to cloned skb in ipv6_hop_ioam() 2024-02-22 09:28:03 +01:00
iucv net/iucv: fix the allocation size of iucv_path_table array 2024-02-16 09:25:09 +00:00
kcm net: kcm: fix direct access to bv_len 2024-01-03 18:37:22 -08:00
key net: fill in MODULE_DESCRIPTION()s for af_key 2024-02-09 14:12:01 -08:00
l2tp l2tp: pass correct message length to ip6_append_data 2024-02-22 10:42:17 +01:00
l3mdev
…
lapb
…
llc llc: call sock_orphan() at release time 2024-01-30 13:49:09 +01:00
mac80211 wifi: mac80211: reload info pointer in ieee80211_tx_dequeue() 2024-02-08 13:16:22 +01:00
mac802154 mac802154: Avoid new associations while disassociating 2023-12-15 11:14:57 +01:00
mctp net: mctp: put sock on tag allocation failure 2024-02-21 17:01:54 -08:00
mpls
…
mptcp mptcp: fix duplicate subflow creation 2024-02-18 10:25:00 +00:00
ncsi net/ncsi: Add NC-SI 1.2 Get MC MAC Address command 2023-11-18 15:00:51 +00:00
netfilter netfilter: nf_tables: use kzalloc for hook allocation 2024-02-22 00:15:58 +01:00
netlabel calipso: fix memory leak in netlbl_calipso_add_pass() 2023-12-07 14:23:12 -05:00
netlink netlink: fix potential sleeping issue in mqueue_flush_file 2024-01-23 11:21:18 +01:00
netrom net: implement lockless SO_PRIORITY 2023-10-01 19:09:54 +01:00
nfc nfc: nci: free rx_data_reassembly skb on NCI device cleanup 2024-01-29 12:05:31 +00:00
nsh
…
openvswitch net: openvswitch: limit the number of recursions from action sets 2024-02-09 12:54:38 -08:00
packet net: fill in MODULE_DESCRIPTION() for AF_PACKET 2024-01-05 08:06:35 -08:00
phonet phonet/pep: fix racy skb_queue_empty() use 2024-02-22 09:05:50 +01:00
psample genetlink: Use internal flags for multicast groups 2023-12-29 08:43:59 +00:00
qrtr net: qrtr: ns: Return 0 if server port is not present 2024-01-01 18:41:29 +00:00
rds net:rds: Fix possible deadlock in rds_message_put 2024-02-13 10:25:30 +01:00
rfkill Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-12-21 22:17:23 +01:00
rose net/rose: fix races in rose_kill_by_device() 2023-12-15 11:59:53 +00:00
rxrpc rxrpc: Fix counting of new acks and nacks 2024-02-05 12:34:07 +00:00
sched net/sched: flower: Add lock protection when remove filter handle 2024-02-21 17:12:03 -08:00
sctp net: sctp: fix skb leak in sctp_inq_free() 2024-02-15 07:34:52 -08:00
smc net: smc: fix spurious error message from __sock_release() 2024-02-14 10:56:02 +00:00
strparser
…
sunrpc NFSv4.1: Assign the right value for initval and retries for rpc timeout 2024-01-29 13:39:48 -05:00
switchdev net: bridge: switchdev: Skip MDB replays of deferred events on offload 2024-02-16 09:36:37 +00:00
tipc tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() 2024-02-06 08:49:26 +01:00
tls tls: don't skip over different type records from the rx_list 2024-02-21 14:25:51 -08:00
unix af_unix: Drop oob_skb ref before purging queue in GC. 2024-02-21 12:40:28 +00:00
vmw_vsock vsock/virtio: use skb_frag_*() helpers 2024-01-03 18:37:16 -08:00
wireless wifi: cfg80211: detect stuck ECSA element in probe resp 2024-02-02 13:08:58 +01:00
x25 net: remove SOCK_DEBUG leftovers 2023-12-26 20:31:01 +00:00
xdp xsk: Add truesize to skb_add_rx_frag(). 2024-02-13 23:10:29 +01:00
xfrm net: fill in MODULE_DESCRIPTION()s for xfrm 2024-02-09 14:12:01 -08:00
Kconfig bpfilter: remove bpfilter 2024-01-04 10:23:10 -08:00
Kconfig.debug
…
Makefile bpfilter: remove bpfilter 2024-01-04 10:23:10 -08:00
compat.c file: stop exposing receive_fd_user() 2023-12-12 14:24:14 +01:00
devres.c
…
socket.c vfs-6.8.iov_iter 2024-01-08 11:43:04 -08:00
sysctl_net.c
…