Paolo Abeni
2ec2dd7d51
net/sched: act_pedit: really ensure the skb is writable ...
[ Upstream commit 8b796475fd7882663a870456466a4fb315cc1bd6 ]
Currently pedit tries to ensure that the accessed skb offset
is writable via skb_unclone(). The action potentially allows
touching any skb bytes, so it may end-up modifying shared data.
The above causes some sporadic MPTCP self-test failures, due to
this code:
tc -n $ns2 filter add dev ns2eth$i egress \
protocol ip prio 1000 \
handle 42 fw \
action pedit munge offset 148 u8 invert \
pipe csum tcp \
index 100
The above modifies a data byte outside the skb head and the skb is
a cloned one, carrying a TCP output packet.
This change addresses the issue by keeping track of a rough
over-estimate highest skb offset accessed by the action and ensuring
such offset is really writable.
Note that this may cause performance regressions in some scenarios,
but hopefully pedit is not in the critical path.
Fixes: db2c24175dhttps://lore.kernel.org/r/1fcf78e6679d0a287dd61bb0f04730ce33b3255d.1652194627.git.pabeni@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-05-18 09:47:25 +02:00
Bluetooth: Fix the creation of hdev->name
2022-05-15 19:54:47 +02:00
net: caif: add proper error handling
2021-06-10 13:37:09 +02:00
netfilter: nf_queue: fix possible use-after-free
2022-03-08 19:07:47 +01:00
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-08 09:01:12 +01:00
NFC: add NCI_UNREG flag to eliminate the race
2021-12-01 09:23:35 +01:00
sctp: use call_rcu to free endpoint
2022-01-05 12:37:44 +01:00
net/sched: act_pedit: really ensure the skb is writable
2022-05-18 09:47:25 +02:00
net: sched: fix police ext initialization
2021-03-04 10:26:53 +01:00
net: bridge: mcast: fix broken length + header check for MRDv6 Adv.
2021-05-14 09:44:32 +02:00
rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
2020-09-09 19:12:23 +02:00
ipv4: Invalidate neighbour for broadcast address upon address addition
2022-04-15 14:18:33 +02:00
ax25: fix reference count leaks of ax25_dev
2022-04-20 09:19:39 +02:00
bonding: fix data-races around agg_select_timer
2022-02-23 11:59:58 +01:00
bonding: make tx_rebalance_counter an atomic
2021-12-14 14:49:00 +01:00
bonding: wait for sysfs kobject destruction before freeing struct slave
2020-12-08 10:40:24 +01:00
net: annotate data race around sk_ll_usec
2021-07-31 08:19:38 +02:00
mac80211: properly handle A-MSDUs that start with an RFC 1042 header
2021-06-03 08:59:01 +02:00
net: Force inlining of checksum functions in net/checksum.h
2022-03-02 11:41:08 +01:00
net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report()
2020-05-27 17:46:24 +02:00
net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
2020-07-22 09:32:47 +02:00
net: fix a memleak when uncloning an skb dst and its metadata
2022-02-16 12:52:51 +01:00
esp: Fix possible buffer overflow in ESP transformation
2022-03-28 08:46:44 +02:00
ipv6: fix memory leak in fib6_rule_suppress
2021-12-08 09:01:13 +01:00
ipv4: Initialize flowi4_multipath_hash in data path
2020-09-26 18:03:12 +02:00
net/sched: flower: fix parsing of ethertype following VLAN header
2022-04-20 09:19:34 +02:00
genetlink: remove genl_bind
2020-07-22 09:32:46 +02:00
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-03-04 10:26:53 +01:00
tcp: relookup sock for RST+ACK packets handled by obsolete req sock
2021-03-30 14:35:26 +02:00
inet_ecn: Fix endianness of checksum update when setting ECT(1)
2020-12-08 10:40:25 +01:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
tcp: fix race condition when creating child sockets from syncookies
2022-04-27 13:50:45 +02:00
ipv4: avoid using shared IP generator for connected sockets
2022-02-01 17:24:37 +01:00
ipv6: annotate accesses to fn->fn_sernum
2022-02-01 17:24:38 +01:00
net: ipv6: fix returned variable type in ip6_skb_dst_mtu
2021-08-12 13:20:57 +02:00
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-08 09:01:12 +01:00
ip_tunnels: Set tunnel option flag when tunnel metadata is present
2020-11-24 13:29:05 +01:00
ipvs: allow connection reuse for unconfirmed conntrack
2020-08-19 08:16:10 +02:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
net: ipv6: add fib6_nh_release_dsts stub
2021-12-01 09:23:33 +01:00
llc: fix out-of-bound array index in llc_sk_dev_hash()
2021-11-17 09:48:47 +01:00
net: llc: fix skb_over_panic
2021-08-04 12:27:39 +02:00
mac80211: populate debugfs only after cfg80211 init
2020-04-29 16:33:18 +02:00
net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
2021-11-17 09:48:49 +01:00
net: make get_net_ns return error if NET_NS is disabled
2021-06-23 14:41:25 +02:00
net: ipv4: Fix rtnexthop len when RTA_FLOW is present
2021-10-06 15:42:33 +02:00
net: ieee802154: handle iftypes as u32
2021-12-01 09:23:32 +01:00
mm: fix struct page layout on 32-bit systems
2021-05-19 10:08:31 +02:00
net: prevent user from passing illegal stab size
2021-10-17 10:42:34 +02:00
psample: Add a fwd declaration for skbuff
2021-08-18 08:56:59 +02:00
sch_red: fix off-by-one checks in red_check_params()
2021-04-14 08:24:14 +02:00
ipv4: remove sparse error in ip_neigh_gw4()
2022-02-01 17:24:39 +01:00
can: dev: Move device back to init netns on owning netns delete
2021-03-30 14:35:29 +02:00
net_sched: restore "mpu xxx" handling
2022-01-27 09:19:55 +01:00
esp: Fix possible buffer overflow in ESP transformation
2022-03-28 08:46:44 +02:00
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
2021-11-17 09:48:48 +01:00
tcp: make sure treq->af_specific is initialized
2022-05-12 12:23:50 +02:00
net/tls: Fix flipped sign in tls_err_abort() calls
2021-11-02 19:46:12 +01:00
udp: call udp_encap_enable for v6 sockets when enabling encap
2022-04-15 14:18:01 +02:00
udp: call udp_encap_enable for v6 sockets when enabling encap
2022-04-15 14:18:01 +02:00
xfrm: Check if_id in xfrm_migrate
2022-03-19 13:40:16 +01:00
2ec2dd7d51