Eric Dumazet 76b338069f ipv6: fix possible use-after-free in ip6_xmit() ...

[ Upstream commit bbd6528d28 ]

In the unlikely case ip6_xmit() has to call skb_realloc_headroom(),
we need to call skb_set_owner_w() before consuming original skb,
otherwise we risk a use-after-free.

Bring IPv6 in line with what we do in IPv4 to fix this.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-09-29 03:07:32 -07:00

..

ila

ila_xlat: add missing hash secret initialization

2017-06-24 07:11:12 +02:00

netfilter

netfilter: x_tables: set module owner for icmp(6) matches

2018-08-24 13:12:36 +02:00

addrconf_core.c

…

addrconf.c

ipv6: avoid dad-failures for addresses with NODAD

2018-04-13 19:47:58 +02:00

addrlabel.c

…

af_inet6.c

ipv6: Fix SO_REUSEPORT UDP socket with implicit sk_ipv6only

2018-02-13 12:35:57 +01:00

ah6.c

ipsec: check return value of skb_to_sgvec always

2018-04-13 19:48:31 +02:00

anycast.c

…

calipso.c

ipv6: make ipv6_renew_options() interrupt/kernel safe

2018-08-24 13:12:36 +02:00

datagram.c

ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull

2018-07-28 07:49:11 +02:00

esp6.c

ipsec: check return value of skb_to_sgvec always

2018-04-13 19:48:31 +02:00

exthdrs_core.c

…

exthdrs_offload.c

…

exthdrs.c

ipv6: make ipv6_renew_options() interrupt/kernel safe

2018-08-24 13:12:36 +02:00

fib6_rules.c

ipv6: Do not leak throw route references

2017-07-05 14:40:16 +02:00

fou6.c

…

icmp.c

…

inet6_connection_sock.c

…

inet6_hashtables.c

…

ip6_checksum.c

udplite: fix partial checksum initialization

2018-03-11 16:21:32 +01:00

ip6_fib.c

ipv6: fix typo in fib6_net_exit()

2017-09-20 08:19:56 +02:00

ip6_flowlabel.c

ipv6: flowlabel: do not leave opt->tot_len with garbage

2017-11-18 11:22:22 +01:00

ip6_gre.c

ip6_gre: better validate user provided tunnel names

2018-04-13 19:48:35 +02:00

ip6_icmp.c

…

ip6_input.c

…

ip6_offload.c

gso_segment: Reset skb->mac_len after modifying network header

2018-09-29 03:07:32 -07:00

ip6_offload.h

…

ip6_output.c

ipv6: fix possible use-after-free in ip6_xmit()

2018-09-29 03:07:32 -07:00

ip6_tunnel.c

ip6_tunnel: use the right value for ipv4 min mtu check in ip6_tnl_xmit

2018-08-22 07:47:13 +02:00

ip6_udp_tunnel.c

…

ip6_vti.c

vti6: remove !skb->ignore_df check from vti6_xmit()

2018-09-15 09:42:56 +02:00

ip6mr.c

ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succeeds

2018-06-13 16:16:42 +02:00

ipcomp6.c

…

ipv6_sockglue.c

ipv6: make ipv6_renew_options() interrupt/kernel safe

2018-08-24 13:12:36 +02:00

Kconfig

…

Makefile

…

mcast_snoop.c

…

mcast.c

ipv6: mcast: fix unsolicited report interval after receiving querys

2018-08-24 13:12:31 +02:00

mip6.c

…

ndisc.c

vrf: check the original netdevice for generating redirect

2018-06-13 16:16:43 +02:00

netfilter.c

…

output_core.c

ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt()

2017-09-20 08:19:52 +02:00

ping.c

net: ping: do not abuse udp_poll()

2017-06-14 15:05:52 +02:00

proc.c

proc: snmp6: Use correct type in memset

2017-07-05 14:40:15 +02:00

protocol.c

…

raw.c

net: ping: do not abuse udp_poll()

2017-06-14 15:05:52 +02:00

reassembly.c

Revert "net: fix percpu memory leaks"

2017-09-20 08:19:55 +02:00

route.c

ipv6: allow PMTU exceptions to local routes

2018-06-26 08:08:06 +08:00

sit.c

Revert "sit: reload iphdr in ipip6_rcv"

2018-07-11 16:26:42 +02:00

syncookies.c

ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()

2017-08-11 08:49:32 -07:00

sysctl_net_ipv6.c

…

tcp_ipv6.c

tcp: verify the checksum of the first data segment in a new connection

2018-06-26 08:08:07 +08:00

tcpv6_offload.c

gso: validate gso_type in GSO handlers

2018-01-31 12:55:55 +01:00

tunnel6.c

…

udp_impl.h

…

udp_offload.c

gso: validate gso_type in GSO handlers

2018-01-31 12:55:55 +01:00

udp.c

udpv6: Fix the checksum computation when HW checksum does not apply

2017-10-12 11:51:20 +02:00

udplite.c

…

xfrm6_input.c

…

xfrm6_mode_beet.c

…

xfrm6_mode_ro.c

ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()

2017-06-14 15:05:51 +02:00

xfrm6_mode_transport.c

ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()

2017-06-14 15:05:51 +02:00

xfrm6_mode_tunnel.c

…

xfrm6_output.c

…

xfrm6_policy.c

xfrm6: avoid potential infinite loop in _decode_session6()

2018-06-26 08:08:05 +08:00

xfrm6_protocol.c

…

xfrm6_state.c

…

xfrm6_tunnel.c

…