redonkable
/
remarkable-linux
1
0
Fork 0
Code Releases Activity
remarkable-linux/net
History
Steffen Klassert 9a54c51001 xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies. 
[ Upstream commit 732706afe1 ]

On policies with a transport mode template, we pass the addresses
from the flowi to xfrm_state_find(), assuming that the IP addresses
(and address family) don't change during transformation.

Unfortunately our policy template validation is not strict enough.
It is possible to configure policies with transport mode template
where the address family of the template does not match the selectors
address family. This lead to stack-out-of-bound reads because
we compare arddesses of the wrong family. Fix this by refusing
such a configuration, address family can not change on transport
mode.

We use the assumption that, on transport mode, the first templates
address family must match the address family of the policy selector.
Subsequent transport mode templates must mach the address family of
the previous template.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2018-02-25 11:05:49 +01:00
..
6lowpan 6lowpan: ndisc: no overreact if no short address is available 2016-09-19 20:19:34 +02:00
9p 9p/trans_virtio: discard zero-length reply 2018-02-22 15:43:50 +01:00
802 net: Kill dev_rebuild_header 2015-03-02 16:43:41 -05:00
8021q 8021q: fix a memory leak for VLAN 0 device 2018-01-17 09:38:52 +01:00
appletalk appletalk: use IS_ENABLED() instead of checking for built-in or module 2016-09-10 21:19:10 -07:00
atm lec: use IS_ENABLED() instead of checking for built-in or module 2016-09-10 21:19:10 -07:00
ax25 ax25: Fix segfault after sock connection timeout 2017-02-04 09:47:09 +01:00
batman-adv batman-adv: Check for alloc errors when preparing TT local data 2016-12-02 10:46:59 +01:00
bluetooth Bluetooth: Prevent stack info leak from the EFS element. 2018-01-17 09:38:56 +01:00
bridge net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks 2018-01-02 20:35:12 +01:00
caif net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx 2017-07-05 14:40:14 +02:00
can can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once 2018-01-31 12:55:50 +01:00
ceph libceph: don't WARN() if user tries to add invalid key 2017-11-30 08:39:03 +00:00
core net: avoid skb_warn_bad_offload on IS_ERR 2018-02-25 11:05:43 +01:00
dcb net: dcb: set error code on failures 2016-12-03 23:54:25 -05:00
dccp dccp: CVE-2017-8824: use-after-free in DCCP code 2018-02-17 13:21:13 +01:00
decnet dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock 2018-02-25 11:05:44 +01:00
dns_resolver KEYS: Fix race between updating and finding a negative key 2017-10-27 10:38:11 +02:00
dsa net: dsa: select NET_SWITCHDEV 2017-11-15 15:53:17 +01:00
ethernet net: introduce device min_header_len 2017-02-18 15:11:43 +01:00
hsr net/hsr: Remove unused but set variable 2016-10-18 10:28:18 -04:00
ieee802154 Revert "net: fix percpu memory leaks" 2017-09-20 08:19:55 +02:00
ipv4 netfilter: on sockopt() acquire sock lock only in the required scope 2018-02-25 11:05:43 +01:00
ipv6 netfilter: on sockopt() acquire sock lock only in the required scope 2018-02-25 11:05:43 +01:00
ipx ipx: call ipxitf_put() in ioctl error path 2017-05-25 15:44:41 +02:00
irda irda: do not leak initialized list.dev to userspace 2017-08-30 10:21:42 +02:00
iucv net/af_iucv: don't use paged skbs for TX on HiperSockets 2017-01-19 20:18:04 +01:00
kcm kcm: Only allow TCP sockets to be attached to a KCM mux 2018-02-25 11:05:40 +01:00
key af_key: fix buffer overread in parse_exthdrs() 2018-01-23 19:57:05 +01:00
l2tp l2tp: cleanup l2tp_tunnel_delete calls 2017-12-20 10:07:31 +01:00
l3mdev net: ipv6: Remove l3mdev_get_saddr6 2016-09-10 23:12:53 -07:00
lapb net/lapb: tuse %*ph to dump buffers 2016-05-29 22:33:25 -07:00
llc net/llc: avoid BUG_ON() in skb_orphan() 2017-02-26 11:10:50 +01:00
mac80211 mac80211: fix the update of path metric for RANN frame 2018-02-03 17:05:37 +01:00
mac802154 mac802154: use rate limited warnings for malformed frames 2016-09-19 20:19:34 +02:00
mpls net: mpls: Fix nexthop alive tracking on down events 2017-12-20 10:07:25 +01:00
ncsi net/ncsi: Improve HNCDSC AEN handler 2016-10-20 11:23:08 -04:00
netfilter netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert 2018-02-25 11:05:43 +01:00
netlabel netlabel: Implement CALIPSO config functions for SMACK. 2016-06-27 15:06:18 -04:00
netlink netlink: Add netns check on taps 2018-01-02 20:35:10 +01:00
netrom netfilter: Remove spurios included of netfilter.h 2015-06-18 21:14:32 +02:00
nfc NFC: fix device-allocation error return 2017-11-30 08:39:07 +00:00
openvswitch openvswitch: fix the incorrect flow action alloc size 2018-02-03 17:05:37 +01:00
packet net/packet: fix a race in packet_bind() and packet_notifier() 2017-12-16 16:25:45 +01:00
phonet sock: struct proto hash function may error 2016-02-11 03:54:14 -05:00
qrtr net: qrtr: Mark 'buf' as little endian 2017-12-09 22:01:51 +01:00
rds rds: tcp: atomically purge entries from rds_tcp_conn_list during netns delete 2018-02-25 11:05:43 +01:00
rfkill rfkill: Use switch to demux userspace operations 2016-04-05 10:48:53 +02:00
rose rose: limit sk_filter trim to payload 2016-07-13 11:53:40 -07:00
rxrpc rxrpc: Ignore BUSY packets on old calls 2017-12-20 10:07:25 +01:00
sched net_sched: red: Avoid illegal values 2018-02-25 11:05:48 +01:00
sctp sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune 2018-02-25 11:05:47 +01:00
strparser strparser: destroy workqueue on module exit 2017-03-22 12:43:33 +01:00
sunrpc SUNRPC: Allow connect to return EHOSTUNREACH 2018-02-03 17:05:39 +01:00
switchdev switchdev: Execute bridge ndos only for bridge ports 2016-10-19 10:58:04 -04:00
tipc tipc: fix a memory leak in tipc_nl_node_get_link() 2018-01-31 12:55:55 +01:00
unix net/unix: don't show information about sockets from other namespaces 2017-11-18 11:22:22 +01:00
vmw_vsock vsock: cancel packets when failing to connect 2017-12-25 14:23:38 +01:00
wimax net:wimax: Fix doucble word "the the" in networking.xml 2015-08-09 22:43:52 -07:00
wireless cfg80211: check dev_set_name() return value 2018-02-25 11:05:40 +01:00
x25 net: x25: remove null checks on arrays calling_ae and called_ae 2016-09-09 18:13:30 -07:00
xfrm xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies. 2018-02-25 11:05:49 +01:00
Kconfig strparser: Stream parser for messages 2016-08-17 19:36:23 -04:00
Makefile strparser: Stream parser for messages 2016-08-17 19:36:23 -04:00
compat.c audit: log 32-bit socketcalls 2017-10-08 10:26:06 +02:00
socket.c bpf: introduce BPF_JIT_ALWAYS_ON config 2018-01-31 12:55:56 +01:00
sysctl_net.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2016-10-06 09:52:23 -07:00