Pull networking fixes from David Miller: "Another week, another set of bug fixes: 1) Fix pskb_pull length in __xfrm_transport_prep(), from Xin Long. 2) Fix double xfrm_state put in esp{4,6}_gro_receive(), also from Xin Long. 3) Re-arm discovery timer properly in mac80211 mesh code, from Linus Lüssing. 4) Prevent buffer overflows in nf_conntrack_pptp debug code, from Pablo Neira Ayuso. 5) Fix race in ktls code between tls_sw_recvmsg() and tls_decrypt_done(), from Vinay Kumar Yadav. 6) Fix crashes on TCP fallback in MPTCP code, from Paolo Abeni. 7) More validation is necessary of untrusted GSO packets coming from virtualization devices, from Willem de Bruijn. 8) Fix endianness of bnxt_en firmware message length accesses, from Edwin Peer. 9) Fix infinite loop in sch_fq_pie, from Davide Caratti. 10) Fix lockdep splat in DSA by setting lockless TX in netdev features for slave ports, from Vladimir Oltean. 11) Fix suspend/resume crashes in mlx5, from Mark Bloch. 12) Fix use after free in bpf fmod_ret, from Alexei Starovoitov. 13) ARP retransmit timer guard uses wrong offset, from Hongbin Liu. 14) Fix leak in inetdev_init(), from Yang Yingliang. 15) Don't try to use inet hash and unhash in l2tp code, results in crashes. From Eric Dumazet" * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (77 commits) l2tp: add sk_family checks to l2tp_validate_socket l2tp: do not use inet_hash()/inet_unhash() net: qrtr: Allocate workqueue before kernel_bind mptcp: remove msk from the token container at destruction time. mptcp: fix race between MP_JOIN and close mptcp: fix unblocking connect() net/sched: act_ct: add nat mangle action only for NAT-conntrack devinet: fix memleak in inetdev_init() virtio_vsock: Fix race condition in virtio_transport_recv_pkt drivers/net/ibmvnic: Update VNIC protocol version reporting NFC: st21nfca: add missed kfree_skb() in an error path neigh: fix ARP retransmit timer guard bpf, selftests: Add a verifier test for assigning 32bit reg states to 64bit ones bpf, selftests: Verifier bounds tests need to be updated bpf: Fix a verifier issue when assigning 32bit reg states to 64bit ones bpf: Fix use-after-free in fmod_ret check net/mlx5e: replace EINVAL in mlx5e_flower_parse_meta() net/mlx5e: Fix MLX5_TC_CT dependencies net/mlx5e: Properly set default values when disabling adaptive moderation net/mlx5e: Fix arch depending casting issue in FEC ...
Showing the changes to include/linux (3 of 69 files). Show all
Unified · Split
| @@ -2047,7 +2047,7 @@ ieee80211_he_ppe_size(u8 ppe_thres_hdr, const u8 *phy_cap_info) · 2046 unmodified lines | |||
| 2047 | } | 2047 | } |
| 2048 | 2048 | ||
| 2049 | /* HE Operation defines */ | 2049 | /* HE Operation defines */ |
| 2050 | #define IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK 0x00000003 | 2050 | #define IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK 0x00000007 |
| 2051 | #define IEEE80211_HE_OPERATION_TWT_REQUIRED 0x00000008 | 2051 | #define IEEE80211_HE_OPERATION_TWT_REQUIRED 0x00000008 |
| 2052 | #define IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK 0x00003ff0 | 2052 | #define IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK 0x00003ff0 |
| 2053 | #define IEEE80211_HE_OPERATION_RTS_THRESHOLD_OFFSET 4 | 2053 | #define IEEE80211_HE_OPERATION_RTS_THRESHOLD_OFFSET 4 |
| @@ -10,7 +10,7 @@ · 9 unmodified lines | |||
| 10 | #include <net/netfilter/nf_conntrack_expect.h> | 10 | #include <net/netfilter/nf_conntrack_expect.h> |
| 11 | #include <uapi/linux/netfilter/nf_conntrack_tuple_common.h> | 11 | #include <uapi/linux/netfilter/nf_conntrack_tuple_common.h> |
| 12 | 12 | ||
| 13 | extern const char *const pptp_msg_name[]; | 13 | const char *pptp_msg_name(u_int16_t msg); |
| 14 | 14 | ||
| 15 | /* state of the control session */ | 15 | /* state of the control session */ |
| 16 | enum pptp_ctrlsess_state { | 16 | enum pptp_ctrlsess_state { |
| @@ -31,6 +31,7 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, · 30 unmodified lines | |||
| 31 | { | 31 | { |
| 32 | unsigned int gso_type = 0; | 32 | unsigned int gso_type = 0; |
| 33 | unsigned int thlen = 0; | 33 | unsigned int thlen = 0; |
| 34 | unsigned int p_off = 0; | ||
| 34 | unsigned int ip_proto; | 35 | unsigned int ip_proto; |
| 35 | 36 | ||
| 36 | if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { | 37 | if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { |
| @@ -68,7 +69,8 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, · 31 unmodified lines | |||
| 68 | if (!skb_partial_csum_set(skb, start, off)) | 69 | if (!skb_partial_csum_set(skb, start, off)) |
| 69 | return -EINVAL; | 70 | return -EINVAL; |
| 70 | 71 | ||
| 71 | if (skb_transport_offset(skb) + thlen > skb_headlen(skb)) | 72 | p_off = skb_transport_offset(skb) + thlen; |
| 73 | if (p_off > skb_headlen(skb)) | ||
| 72 | return -EINVAL; | 74 | return -EINVAL; |
| 73 | } else { | 75 | } else { |
| 74 | /* gso packets without NEEDS_CSUM do not set transport_offset. | 76 | /* gso packets without NEEDS_CSUM do not set transport_offset. |
| @@ -92,23 +94,32 @@ retry: · 17 unmodified lines | |||
| 92 | return -EINVAL; | 94 | return -EINVAL; |
| 93 | } | 95 | } |
| 94 | 96 | ||
| 95 | if (keys.control.thoff + thlen > skb_headlen(skb) || | 97 | p_off = keys.control.thoff + thlen; |
| 98 | if (p_off > skb_headlen(skb) || | ||
| 96 | keys.basic.ip_proto != ip_proto) | 99 | keys.basic.ip_proto != ip_proto) |
| 97 | return -EINVAL; | 100 | return -EINVAL; |
| 98 | 101 | ||
| 99 | skb_set_transport_header(skb, keys.control.thoff); | 102 | skb_set_transport_header(skb, keys.control.thoff); |
| 103 | } else if (gso_type) { | ||
| 104 | p_off = thlen; | ||
| 105 | if (p_off > skb_headlen(skb)) | ||
| 106 | return -EINVAL; | ||
| 100 | } | 107 | } |
| 101 | } | 108 | } |
| 102 | 109 | ||
| 103 | if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { | 110 | if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { |
| 104 | u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); | 111 | u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); |
| 112 | struct skb_shared_info *shinfo = skb_shinfo(skb); | ||
| 105 | 113 | ||
| 106 | skb_shinfo(skb)->gso_size = gso_size; | 114 | /* Too small packets are not really GSO ones. */ |
| 107 | skb_shinfo(skb)->gso_type = gso_type; | 115 | if (skb->len - p_off > gso_size) { |
| 116 | shinfo->gso_size = gso_size; | ||
| 117 | shinfo->gso_type = gso_type; | ||
| 108 | 118 | ||
| 109 | /* Header must be checked, and gso_segs computed. */ | 119 | /* Header must be checked, and gso_segs computed. */ |
| 110 | skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY; | 120 | shinfo->gso_type |= SKB_GSO_DODGY; |
| 111 | skb_shinfo(skb)->gso_segs = 0; | 121 | shinfo->gso_segs = 0; |
| 122 | } | ||
| 112 | } | 123 | } |
| 113 | 124 | ||
| 114 | return 0; | 125 | return 0; |