Eric Dumazet
bb1fceca22
tcp: fix use after free in tcp_xmit_retransmit_queue() ...
When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the
tail of the write queue using tcp_add_write_queue_tail()
Then it attempts to copy user data into this fresh skb.
If the copy fails, we undo the work and remove the fresh skb.
Unfortunately, this undo lacks the change done to tp->highest_sack and
we can leave a dangling pointer (to a freed skb)
Later, tcp_xmit_retransmit_queue() can dereference this pointer and
access freed memory. For regular kernels where memory is not unmapped,
this might cause SACK bugs because tcp_highest_sack_seq() is buggy,
returning garbage instead of tp->snd_nxt, but with various debug
features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel.
This bug was found by Marco Grassi thanks to syzkaller.
Fixes: 6859d49475
2016-08-18 23:22:57 -07:00
Bluetooth: Add debugfs fields for hardware and firmware info
2016-07-18 09:33:28 +03:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2016-07-24 22:02:36 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
2016-06-01 17:54:19 -07:00
NFC: digital: Add support for NFC DEP Response Waiting Time
2016-07-11 02:01:14 +02:00
sock: struct proto hash function may error
2016-02-11 03:54:14 -05:00
sctp: change to use TCP_CLOSE_WAIT as SCTP_SS_CLOSING
2016-08-01 13:32:50 -07:00
net_sched: get rid of struct tcf_common
2016-07-25 21:49:20 -07:00
6lowpan: add 802.15.4 short addr slaac
2016-06-15 20:41:22 -07:00
net_sched: convert tcf_exts from list to pointer array
2016-08-17 19:27:51 -04:00
ipv6: export several functions
2016-06-15 20:41:23 -07:00
rxrpc: Fix races between skb free, ACK generation and replying
2016-08-06 00:08:40 -04:00
unix: correctly track in-flight fds in sending process user_struct
2016-02-08 10:30:42 -05:00
VSOCK: Introduce virtio_vsock_common.ko
2016-08-02 02:57:29 +03:00
bonding: 3ad: apply ad_actor settings changes immediately
2016-02-09 04:45:49 -05:00
bonding: prevent out of bound accesses
2016-07-01 06:06:09 -04:00
calipso: Add a label cache.
2016-06-27 15:06:17 -04:00
cfg80211: Add mesh peer AID setting API
2016-07-06 15:04:52 +02:00
ieee802154: add netns support
2016-07-08 12:20:57 +02:00
csum: Update csum_block_add to use rotate instead of byteswap
2016-03-13 15:01:00 -04:00
cls_cgroup: get sk_classid only from full sockets
2016-04-19 20:09:25 -04:00
codel: split into multiple files
2016-04-25 16:44:27 -04:00
codel: split into multiple files
2016-04-25 16:44:27 -04:00
net_sched: fq_codel: cache skb->truesize into skb->cb
2016-06-25 12:19:35 -04:00
packet: compat support for sock_fprog
2016-06-09 23:41:03 -07:00
net/devlink: Add E-Switch mode control
2016-07-02 14:40:40 -04:00
net: dsa: support switchdev ageing time attr
2016-07-19 19:42:01 -07:00
route: move lwtunnel state to a single place
2016-04-25 16:20:09 -04:00
net: add dst_cache support
2016-02-16 20:21:48 -05:00
ip_tunnel: add support for setting flow label via collect metadata
2016-03-11 15:14:26 -05:00
net: Add l3mdev rule
2016-06-08 11:36:02 -07:00
ipv6, trace: fix tos reporting on fib6_table_lookup
2016-03-20 13:44:34 -04:00
net/flow_dissector: Make dissector_uses_key() and skb_flow_dissector_target() public
2016-03-10 16:24:02 -05:00
fou: Add encap ops for IPv6 tunnels
2016-05-20 18:03:16 -04:00
fq: add fair queuing framework
2016-04-25 16:45:53 -04:00
fq: split out backlog update logic
2016-04-28 17:03:38 -04:00
net: sched: do not acquire qdisc spinlock in qdisc/class stats dump
2016-06-07 16:37:14 -07:00
Revert "genl: Add genlmsg_new_unicast() for unicast message allocation"
2016-02-18 11:42:19 -05:00
net: Remove deprecated tunnel specific UDP offload functions
2016-06-17 20:23:32 -07:00
gre: set inner_protocol on xmit
2016-08-15 13:37:12 -07:00
gro_cells: gro_cells_receive now return error code
2016-07-22 00:50:41 -04:00
gtp: #define #define _GTP_H_ and not #define _GTP_H
2016-07-25 17:55:43 -07:00
net: add a hardware buffer management helper API
2016-03-14 12:19:46 -04:00
net: snmp: kill STATS_BH macros
2016-04-27 22:48:25 -04:00
mac802154: constify ieee802154_llsec_ops structure
2016-01-04 20:40:41 +01:00
ila: Add generic ILA translation facility
2015-12-15 23:25:20 -05:00
ipv6: remove unused in6_addr struct
2016-03-22 15:45:44 -04:00
tcp/dccp: do not touch listener sk_refcnt under synflood
2016-04-04 22:11:20 -04:00
ip4ip6: Support for GSO/GRO
2016-05-20 18:03:17 -04:00
tcp/dccp: fix another race at listener dismantle
2016-02-18 11:35:51 -05:00
ipv6: suppress sparse warnings in IP6_ECN_set_ce()
2016-08-13 15:08:00 -07:00
ipv4: namespacify ip fragment max dist sysctl knob
2016-02-16 20:42:54 -05:00
tcp/dccp: do not touch listener sk_refcnt under synflood
2016-04-04 22:11:20 -04:00
ipv6: Allow request socks to contain IPv6 options.
2016-06-27 15:05:28 -04:00
inet: tcp: fix inetpeer_set_addr_v4()
2015-12-16 00:14:12 -05:00
net/ipv4: Introduce IPSKB_FRAG_SEGS bit to inet_skb_parm.flags
2016-07-19 16:40:22 -07:00
ipv6: Pass proto to csum_ipv6_magic as __u8 instead of unsigned short
2016-03-13 23:55:13 -04:00
net: ipv6: Move ip6_route_get_saddr to inline
2016-06-17 21:25:29 -07:00
ipv6: hide ip6_encap_hlen/ip6_tnl_encap definitions
2016-05-29 22:24:21 -07:00
route: check and remove route cache when we get route
2016-02-18 11:31:36 -05:00
gre: better support for ICMP messages for gre+ipv6
2016-06-18 22:11:39 -07:00
ipvs: update real-server binding of outgoing connections in SIP-pe
2016-06-06 09:47:25 +09:00
Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/selinux into next
2016-07-07 10:15:34 +10:00
cfg80211/wext: fix message ordering
2016-01-29 17:13:43 +01:00
kcm: mark helper functions inline
2016-03-10 14:42:03 -05:00
net: ipv6: Address selection needs to consider L3 domains
2016-06-17 21:25:29 -07:00
lwtunnel: autoload of lwt modules
2016-02-21 22:00:28 -05:00
mac80211: Add ieee80211_hw pointer to get_expected_throughput
2016-08-05 14:23:25 +02:00
ieee802154: cleanup WARN_ON for fc fetch
2016-07-08 13:23:12 +02:00
net/ncsi: Package and channel management
2016-07-19 20:49:17 -07:00
6lowpan: introduce 6lowpan-nd
2016-06-15 20:41:23 -07:00
treewide: replace obsolete _refok by __ref
2016-08-02 17:31:41 -04:00
neigh: Send a notification when DELAY_PROBE_TIME changes
2016-07-05 09:06:29 -07:00
netlabel: Implement CALIPSO config functions for SMACK.
2016-06-27 15:06:18 -04:00
netlink: kill nla_put_u64()
2016-05-16 13:46:23 -04:00
net: wrap sock->sk_cgrp_prioidx and ->sk_classid inside a struct
2015-12-08 22:02:33 -05:00
ieee802154: add netns support
2016-07-08 12:20:57 +02:00
net: ping: make ping_v6_sendmsg static
2016-03-23 22:09:58 -04:00
net_sched: convert tcf_exts from list to pointer array
2016-08-17 19:27:51 -04:00
net_sched: remove generic throttled management
2016-06-10 23:58:21 -07:00
udp: Remove udp_offloads
2016-04-07 16:53:30 -04:00
sock: struct proto hash function may error
2016-02-11 03:54:14 -05:00
inet: reqsk_alloc() needs to take care of dead listeners
2016-04-04 22:11:19 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2016-04-23 18:51:33 -04:00
net: rtnetlink: add support for the IFLA_STATS_LINK_XSTATS_SLAVE attribute
2016-06-30 06:15:04 -04:00
net_sched: generalize bulk dequeue
2016-06-25 12:19:35 -04:00
unix: correctly track in-flight fds in sending process user_struct
2016-02-08 10:30:42 -05:00
net: snmp: fix 64bit stats on 32bit arches
2016-04-28 11:49:45 -04:00
dccp: limit sk_filter trim to payload
2016-07-13 11:53:41 -07:00
soreuseport: fix NULL ptr dereference SO_REUSEPORT after bind
2016-01-19 14:44:23 -05:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2016-07-24 00:53:32 -04:00
tcp: fix use after free in tcp_xmit_retransmit_queue()
2016-08-18 23:22:57 -07:00
ipv6: add new struct ipcm6_cookie
2016-05-03 16:08:14 -04:00
udp: avoid csum_partial() for validated skb
2016-06-01 17:41:36 -07:00
vxlan: Add new UDP encapsulation offload type for VXLAN-GPE
2016-06-17 20:23:32 -07:00
net: Remove deprecated tunnel specific UDP offload functions
2016-06-17 20:23:32 -07:00
net: xfrm: kill XFRM_INC_STATS_BH()
2016-04-27 22:48:23 -04:00
bb1fceca22