Junwei Hu ef0efcd3bd ipv6: Fix dangling pointer when ipv6 fragment ... At the beginning of ip6_fragment func, the prevhdr pointer is obtained in the ip6_find_1stfragopt func. However, all the pointers pointing into skb header may change when calling skb_checksum_help func with skb->ip_summed = CHECKSUM_PARTIAL condition. The prevhdr pointe will be dangling if it is not reloaded after calling __skb_linearize func in skb_checksum_help func. Here, I add a variable, nexthdr_offset, to evaluate the offset, which does not changes even after calling __skb_linearize func. Fixes: 405c92f7a5 ("ipv6: add defensive check for CHECKSUM_PARTIAL skbs in ip_fragment") Signed-off-by: Junwei Hu <hujunwei4@huawei.com> Reported-by: Wenhao Zhang <zhangwenhao8@huawei.com> Reported-by: syzbot+e8ce541d095e486074fc@syzkaller.appspotmail.com Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com> Acked-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-04-03 21:42:20 -07:00
..
6lowpan
9p	9p/net: fix memory leak in p9_client_create	2019-03-13 11:50:04 +01:00
802
8021q
appletalk	appletalk: Fix potential NULL pointer dereference in unregister_snap_client	2019-03-15 11:25:48 -07:00
atm	net: atm: Add another IS_ENABLED(CONFIG_COMPAT) in atm_dev_ioctl	2019-03-07 10:14:50 -08:00
ax25
batman-adv	batman-adv: Fix genl notification for throughput_override	2019-03-25 09:31:19 +01:00
bluetooth
bpf	bpf: fix warning about using plain integer as NULL	2019-03-08 21:17:07 +01:00
bpfilter
bridge	netfilter: bridge: set skb transport_header before entering NF_INET_PRE_ROUTING	2019-03-18 16:21:54 +01:00
caif
can
ceph	libceph: wait for latest osdmap in ceph_monc_blacklist_add()	2019-03-20 16:27:40 +01:00
core	net-gro: Fix GRO flush when receiving a GSO packet.	2019-04-03 21:40:52 -07:00
dcb
dccp	dccp: Fix memleak in __feat_register_sp	2019-04-01 18:15:10 -07:00
decnet
dns_resolver
dsa	net: dsa: Implement flow_dissect callback for tag_qca	2019-03-28 16:57:19 -07:00
ethernet
hsr	net/hsr: fix possible crash in add_timer()	2019-03-07 11:02:08 -08:00
ieee802154
ife
ipv4	vrf: check accept_source_route on the original netdevice	2019-04-01 10:44:58 -07:00
ipv6	ipv6: Fix dangling pointer when ipv6 fragment	2019-04-03 21:42:20 -07:00
iucv
kcm	kcm: switch order of device registration to fix a crash	2019-04-01 14:59:20 -07:00
key
l2tp	l2tp: fix infoleak in l2tp_ip6_recvmsg()	2019-03-13 14:19:35 -07:00
l3mdev
lapb
llc
mac80211
mac802154
mpls	mpls: Fix 6PE forwarding	2019-03-19 16:00:22 -07:00
ncsi	net: ncsi: fix a missing check for nla_nest_start	2019-03-16 11:44:33 -07:00
netfilter	netfilter: nf_tables: add missing ->release_ops() in error path of newrule()	2019-03-20 08:32:58 +01:00
netlabel	netlabel: fix out-of-bounds memory accesses	2019-02-27 21:45:24 -08:00
netlink	genetlink: Fix a memory leak on error path	2019-03-21 09:29:06 -07:00
netrom
nfc	nfc: Fix to check for kmemdup failure	2019-03-19 13:48:07 -07:00
nsh
openvswitch	openvswitch: fix flow actions reallocation	2019-03-28 17:15:44 -07:00
packet	net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec	2019-03-20 10:46:50 -07:00
phonet
psample
qrtr	mm: replace all open encodings for NUMA_NO_NODE	2019-03-05 21:07:14 -08:00
rds	net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock().	2019-03-28 17:17:18 -07:00
rfkill
rose	net: rose: fix a possible stack overflow	2019-03-18 16:53:22 -07:00
rxrpc	rxrpc: avoid clang -Wuninitialized warning	2019-03-23 21:48:30 -04:00
sched	net: sched: introduce and use qdisc tree flush/purge helpers	2019-04-01 14:50:13 -07:00
sctp	sctp: initialize _pad of sockaddr_in before copying to user memory	2019-04-01 18:08:19 -07:00
smc	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-12 13:27:20 -07:00
strparser	net: strparser: fix a missing check for create_singlethread_workqueue	2019-03-15 12:51:56 -07:00
sunrpc	SUNRPC: fix uninitialized variable warning	2019-03-26 13:04:32 -07:00
switchdev	switchdev: Remove unused transaction item queue	2019-03-01 21:35:19 -08:00
tipc	tipc: handle the err returned from cmd header function	2019-03-31 16:45:57 -07:00
tls	net: tls: prevent false connection termination with offload	2019-03-29 13:38:50 -07:00
unix	io_uring-2019-03-06	2019-03-08 14:48:40 -08:00
vmw_vsock	vsock/virtio: fix kernel panic from virtio_transport_reset_no_sock	2019-03-08 15:15:44 -08:00
wimax
wireless
x25	net/x25: reset state in x25_connect()	2019-03-11 15:40:14 -07:00
xdp	xsk: fix umem memory leak on cleanup	2019-03-16 01:27:51 +01:00
xfrm
compat.c	Merge branch 'timers-2038-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2019-03-05 14:08:26 -08:00
Kconfig
Makefile	net: split out functions related to registering inflight socket files	2019-02-28 08:24:23 -07:00
socket.c	net: add documentation to socket.c	2019-03-15 15:29:47 -07:00
sysctl_net.c