Herbert Xu e095ecaec6 xfrm: Reinject transport-mode packets through tasklet ... [ Upstream commit acf568ee85 ] This is an old bugbear of mine: https://www.mail-archive.com/netdev@vger.kernel.org/msg03894.html By crafting special packets, it is possible to cause recursion in our kernel when processing transport-mode packets at levels that are only limited by packet size. The easiest one is with DNAT, but an even worse one is where UDP encapsulation is used in which case you just have to insert an UDP encapsulation header in between each level of recursion. This patch avoids this problem by reinjecting tranport-mode packets through a tasklet. Fixes: b05e106698 ("[IPV4/6]: Netfilter IPsec input hooks") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-03-03 10:24:25 +01:00
..
Kconfig	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2017-02-16 21:25:49 -05:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm_algo.c	xfrm: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:11 -07:00
xfrm_device.c	xfrm: Fix negative device refcount on offload failure.	2017-09-11 10:36:51 +02:00
xfrm_hash.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm_hash.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm_input.c	xfrm: Reinject transport-mode packets through tasklet	2018-03-03 10:24:25 +01:00
xfrm_ipcomp.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-11-04 13:48:30 -05:00
xfrm_output.c	xfrm: Fix GSO for IPsec with GRE tunnel.	2017-10-31 09:20:35 +01:00
xfrm_policy.c	xfrm: Fix stack-out-of-bounds read on socket policy lookup.	2018-02-25 11:07:47 +01:00
xfrm_proc.c	proc: Reduce cache miss in xfrm_statistics_seq_show	2016-09-30 01:50:45 -04:00
xfrm_replay.c	xfrm: Add xfrm_replay_overflow functions for offloading	2017-04-14 10:07:01 +02:00
xfrm_state.c	xfrm: fix rcu usage in xfrm_get_type_offload	2018-02-25 11:07:46 +01:00
xfrm_sysctl.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm_user.c	xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.	2018-02-25 11:08:02 +01:00