Florian Westphal
df1cc4066f
UPSTREAM: net: fix fraglist segmentation reference count leak ...
Xin Long says:
On udp rx path udp_rcv_segment() may do segment where the frag skbs
will get the header copied from the head skb in skb_segment_list()
by calling __copy_skb_header(), which could overwrite the frag skbs'
extensions by __skb_ext_copy() and cause a leak.
This issue was found after loading esp_offload where a sec path ext
is set in the skb.
Fix this by discarding head state of the fraglist skb before replacing
its contents.
Fixes: 3a1296a38d0cf62 ("net: Support GRO/GSO fraglist chaining.")
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Reported-by: Xiumei Mu <xmu@redhat.com>
Tested-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit cf673ed0e057a2dd68d930c6d7e30d53c70c5789)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iba886d897485ddddb2f1f67347b65fbba4d3e119
2020-11-14 16:55:56 +01:00
net/9p: validate fds in p9_fd_open
2020-08-11 15:33:36 +02:00
appletalk: Fix atalk_proc_init() return path
2020-08-11 15:33:40 +02:00
AX.25: Prevent integer overflows in connect and sendmsg
2020-07-31 18:39:31 +02:00
Bluetooth: add a mutex lock to avoid UAF in do_enale_set
2020-08-19 08:15:59 +02:00
bridge: mcast: Fix MLD2 Report IPv6 payload length check
2020-07-22 09:32:46 +02:00
ANDROID: GKI: Fix up "do not export symbol_get/put()" commit
2020-08-01 14:28:51 +02:00
can: j1939: add rxtimer for multipacket broadcast session
2020-08-26 10:41:02 +02:00
libceph: don't omit recovery_deletes in target_copy()
2020-07-22 09:33:17 +02:00
UPSTREAM: net: fix fraglist segmentation reference count leak
2020-11-14 16:55:56 +01:00
UPSTREAM: udp: initialize is_flist with 0 in udp_gro_receive
2020-09-09 08:48:11 +00:00
UPSTREAM: udp: Support UDP fraglist GRO/GSO.
2020-09-09 08:48:03 +00:00
xfrm: policy: match with both mark and mask on user interfaces
2020-08-05 09:59:44 +02:00
l2tp: remove skb_dst_set() from l2tp_xmit_skb()
2020-07-22 09:32:47 +02:00
llc: make sure applications use ARPHRD_ETHER
2020-07-22 09:32:47 +02:00
UPSTREAM: mac80211: fix warning in 6 GHz IE addition in mesh mode
2020-11-14 16:29:38 +01:00
ANDROID: GKI: net: add vendor hooks for 'struct nf_conn' lifecycle
2020-10-30 10:02:26 +01:00
Revert "Revert "genetlink: remove genl_bind""
2020-08-13 15:45:33 +02:00
net/nfc/rawsock.c: add CAP_NET_RAW check.
2020-08-19 08:16:22 +02:00
openvswitch: Prevent kernel-infoleak in ovs_ct_put_key()
2020-08-11 15:33:41 +02:00
af_packet: TPACKET_V3: fix fill status rwlock imbalance
2020-08-19 08:16:22 +02:00
qrtr: orphan socket in qrtr_release()
2020-07-31 18:39:30 +02:00
rds: Prevent kernel-infoleak in rds_notify_queue_get()
2020-08-05 09:59:44 +02:00
rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
2020-08-11 15:33:40 +02:00
sched: consistently handle layer3 header accesses in the presence of VLANs
2020-07-22 09:32:48 +02:00
This is the 5.4.55 stable release
2020-08-01 11:46:55 +02:00
svcrdma: Fix another Receive buffer leak
2020-08-26 10:40:55 +02:00
net/tls: Fix kmap usage
2020-08-19 08:16:23 +02:00
vsock/virtio: annotate 'the_virtio_vsock' RCU pointer
2020-07-29 10:18:31 +02:00
UPSTREAM: nl80211: fix memory leak when parsing NL80211_ATTR_HE_BSS_COLOR
2020-11-14 16:43:07 +01:00
net/x25: Fix null-ptr-deref in x25_disconnect
2020-08-05 09:59:44 +02:00
ANDROID: Temporarily disable XFRM_USER_COMPAT filtering
2020-11-05 21:08:28 +00:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
This is the 5.4.59 stable release
2020-08-19 08:40:57 +02:00
df1cc4066f