Liu Jian 8fea6446ef bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes ...

commit 45969b4152 upstream.

The data length of skb frags + frag_list may be greater than 0xffff, and
skb_header_pointer can not handle negative offset. So, here INT_MAX is used
to check the validity of offset. Add the same change to the related function
skb_store_bytes.

Fixes: 05c74e5e53 ("bpf: add bpf_skb_load_bytes helper")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Song Liu <songliubraving@fb.com>
Link: https://lore.kernel.org/bpf/20220416105801.88708-2-liujian56@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2022-06-06 08:19:46 +02:00

..

6lowpan

…

9p

…

802

…

8021q

…

appletalk

…

atm

…

ax25

ax25: Fix NULL pointer dereference in ax25_kill_by_device

2022-03-16 12:49:00 +01:00

batman-adv

batman-adv: Don't expect inter-netns unique iflink indices

2022-03-16 12:49:01 +01:00

bluetooth

Bluetooth: Fix the creation of hdev->name

2022-05-15 19:39:17 +02:00

bridge

netfilter: bridge: add support for pppoe filtering

2022-01-27 08:47:33 +01:00

caif

…

can

can: bcm: fix UAF of bcm op

2022-02-08 18:15:26 +01:00

ceph

…

core

bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes

2022-06-06 08:19:46 +02:00

dcb

net: dcb: disable softirqs in dcbnl_flush_dev()

2022-03-08 19:00:59 +01:00

dccp

…

decnet

…

dns_resolver

…

dsa

…

ethernet

…

hsr

…

ieee802154

net: ieee802154: Return meaningful error codes from the netlink helpers

2022-02-08 18:15:29 +01:00

ipv4

ping: fix address binding wrt vrf

2022-05-18 09:15:44 +02:00

ipv6

net: ipv6: ensure we call ipv6_mc_down() at most once

2022-05-12 12:14:58 +02:00

ipx

…

irda

…

iucv

…

kcm

…

key

net: af_key: check encryption module availability consistency

2022-06-06 08:19:45 +02:00

l2tp

…

l3mdev

…

lapb

…

llc

llc: only change llc->dev when bind() succeeds

2022-03-28 08:06:06 +02:00

mac80211

mac80211: fix rx reordering with non explicit / psmp ack policy

2022-05-25 08:39:50 +02:00

mac802154

…

mpls

…

ncsi

…

netfilter

netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options

2022-04-20 09:06:37 +02:00

netlabel

cipso,calipso: resolve a number of problems with the DOI refcounts

2022-01-27 08:47:42 +01:00

netlink

netlink: do not reset transport header in netlink_recvmsg()

2022-05-18 09:15:43 +02:00

netrom

…

nfc

NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc

2022-05-25 08:39:49 +02:00

openvswitch

openvswitch: fix OOB access in reserve_sfa_size()

2022-04-27 13:14:11 +02:00

packet

net/packet: fix packet_sock xmit return value checking

2022-04-27 13:14:10 +02:00

phonet

phonet: refcount leak in pep_sock_accep

2022-01-11 13:38:12 +01:00

qrtr

…

rds

…

rfkill

…

rose

…

rxrpc

…

sched

net: sched: prevent UAF on tc_ctl_tfilter when temporarily dropping rtnl_lock

2022-05-12 12:14:58 +02:00

sctp

sctp: fix kernel-infoleak for SCTP sockets

2022-03-16 12:49:01 +01:00

strparser

…

sunrpc

Revert "SUNRPC: attempt AF_LOCAL connect on setup"

2022-05-12 12:14:56 +02:00

switchdev

…

tipc

tipc: rate limit warning for received illegal binding update

2022-02-16 12:43:54 +01:00

unix

af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress

2022-01-27 08:47:41 +01:00

vmw_vsock

vsock: remove vsock from connected table when connect is interrupted by a signal

2022-02-23 11:56:40 +01:00

wimax

…

wireless

nl80211: Update bss channel on channel switch for P2P_CLIENT

2022-03-23 09:00:33 +01:00

x25

net/x25: Fix null-ptr-deref caused by x25_disconnect

2022-04-20 09:06:38 +02:00

xfrm

xfrm: policy: match with both mark and mask on user interfaces

2022-04-20 09:06:44 +02:00

compat.c

…

Kconfig

…

Makefile

…

socket.c

…

sysctl_net.c

…