Eric Dumazet cebff3d9f7 ipv6: fix out-of-bound access in ip6_parse_tlv() ... [ Upstream commit 624085a31c1ad6a80b1e53f686bf6ee92abbf6e8 ] First problem is that optlen is fetched without checking there is more than one byte to parse. Fix this by taking care of IPV6_TLV_PAD1 before fetching optlen (under appropriate sanity checks against len) Second problem is that IPV6_TLV_PADN checks of zero padding are performed before the check of remaining length. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Fixes: c1412fce7e ("net/ipv6/exthdrs.c: Strict PadN option checking") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Tom Herbert <tom@herbertland.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-07-14 16:56:28 +02:00
..
ila
netfilter	netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local	2021-06-23 14:42:42 +02:00
addrconf_core.c
addrconf.c	net: ipv4: Remove unneed BUG() function	2021-06-30 08:47:20 -04:00
addrlabel.c
af_inet6.c
ah6.c	xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume	2021-04-14 08:42:05 +02:00
anycast.c
calipso.c	cipso,calipso: resolve a number of problems with the DOI refcounts	2021-03-17 17:06:15 +01:00
datagram.c
esp6_offload.c	xfrm: Provide private skb extensions for segmented and hw offloaded ESP packets	2021-04-14 08:42:07 +02:00
esp6.c	xfrm: xfrm_state_mtu should return at least 1280 for ipv6	2021-07-14 16:56:14 +02:00
exthdrs_core.c
exthdrs_offload.c
exthdrs.c	ipv6: fix out-of-bound access in ip6_parse_tlv()	2021-07-14 16:56:28 +02:00
fib6_notifier.c
fib6_rules.c
fou6.c
icmp.c	net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending	2021-03-04 11:38:46 +01:00
inet6_connection_sock.c
inet6_hashtables.c
ip6_checksum.c
ip6_fib.c	ipv6: fix suspecious RCU usage warning	2021-03-30 14:31:57 +02:00
ip6_flowlabel.c
ip6_gre.c	ipv6: remove extra dev_hold() for fallback tunnels	2021-05-22 11:40:55 +02:00
ip6_icmp.c	net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending	2021-03-04 11:38:46 +01:00
ip6_input.c	ipv6: weaken the v4mapped source check	2021-03-30 14:32:01 +02:00
ip6_offload.c
ip6_offload.h
ip6_output.c	net: ipv6: Validate GSO SKB before finish IPv6 processing	2021-01-23 16:04:00 +01:00
ip6_tunnel.c	ip6_tunnel: fix GRE6 segmentation	2021-07-14 16:56:25 +02:00
ip6_udp_tunnel.c
ip6_vti.c	ipv6: remove extra dev_hold() for fallback tunnels	2021-05-22 11:40:55 +02:00
ip6mr.c
ipcomp6.c
ipv6_sockglue.c
Kconfig
Makefile
mcast_snoop.c	net: bridge: mcast: fix broken length + header check for MRDv6 Adv.	2021-05-14 09:50:44 +02:00
mcast.c	mld: fix panic in mld_newpack()	2021-06-03 09:00:48 +02:00
mip6.c
ndisc.c
netfilter.c
output_core.c
ping.c
proc.c
protocol.c
raw.c	net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind()	2021-04-14 08:42:02 +02:00
reassembly.c	ipv6: record frag_max_size in atomic fragments in input path	2021-06-03 09:00:50 +02:00
route.c	ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions	2021-06-10 13:39:20 +02:00
rpl_iptunnel.c
rpl.c
seg6_hmac.c
seg6_iptunnel.c
seg6_local.c
seg6.c
sit.c	ipv6: remove extra dev_hold() for fallback tunnels	2021-05-22 11:40:55 +02:00
syncookies.c
sysctl_net_ipv6.c
tcp_ipv6.c	ipv6: weaken the v4mapped source check	2021-03-30 14:32:01 +02:00
tcpv6_offload.c
tunnel6.c
udp_impl.h
udp_offload.c	udp: ipv4: manipulate network header of NATed UDP GRO fraglist	2021-02-10 09:29:23 +01:00
udp.c	udp: fix race between close() and udp_abort()	2021-06-23 14:42:42 +02:00
udplite.c
xfrm6_input.c
xfrm6_output.c
xfrm6_policy.c
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c