forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/net
History
Hannes Frederic Sowa 024abeeced ipv6: fix headroom calculation in udp6_ufo_fragment 
[ Upstream commit 0e033e04c2 ]

Commit 1e2bd517c1 ("udp6: Fix udp
fragmentation for tunnel traffic.") changed the calculation if
there is enough space to include a fragment header in the skb from a
skb->mac_header dervived one to skb_headroom. Because we already peeled
off the skb to transport_header this is wrong. Change this back to check
if we have enough room before the mac_header.

This fixes a panic Saran Neti reported. He used the tbf scheduler which
skb_gso_segments the skb. The offsets get negative and we panic in memcpy
because the skb was erroneously not expanded at the head.

Reported-by: Saran Neti <Saran.Neti@telus.com>
Cc: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-08 07:29:23 -08:00
..
9p 9p: send uevent after adding/removing mount_tag attribute 2013-12-04 10:57:19 -08:00
802 net/802/mrp: fix lockdep splat 2013-05-14 13:02:30 -07:00
8021q net: vlan: fix nlmsg size calculation in vlan_get_size() 2013-11-04 04:31:02 -08:00
appletalk appletalk: info leak in ->getname() 2013-04-25 01:47:58 -04:00
atm Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-05-01 17:51:54 -07:00
ax25 ax25: fix info leak via msg_name in ax25_recvmsg() 2013-04-07 16:28:00 -04:00
batman-adv batman-adv: set up network coding packet handlers during module init 2013-11-20 12:27:47 -08:00
bluetooth Bluetooth: Fix rfkill functionality during the HCI setup stage 2013-10-13 16:08:32 -07:00
bridge bridge: Correctly clamp MAX forward_delay when enabling STP 2013-11-04 04:31:03 -08:00
caif caif: Add missing braces to multiline if in cfctrl_linkup_request 2013-10-13 16:08:28 -07:00
can Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-05-01 17:51:54 -07:00
ceph libceph: use pg_num_mask instead of pgp_num_mask for pg.seed calc 2013-09-26 17:18:29 -07:00
core net: flow_dissector: fail on evil iph->ihl 2013-11-20 12:27:46 -08:00
dcb rtnetlink: Remove passing of attributes into rtnl_doit functions 2013-03-22 10:31:16 -04:00
dccp net:dccp: do not report ICMP redirects to user space 2013-10-13 16:08:30 -07:00
decnet decnet: remove duplicated include from dn_table.c 2013-04-07 17:12:01 -04:00
dns_resolver
dsa dsa: fix freeing of sparse port allocation 2013-03-25 12:23:41 -04:00
ethernet net: add ETH_P_802_3_MIN 2013-03-28 01:20:42 -04:00
ieee802154 ieee802154/nl-mac.c: make some MLME operations optional 2013-04-08 12:00:16 -04:00
ipv4 ip_gre: Fix WCCPv2 header parsing. 2013-11-20 12:27:46 -08:00
ipv6 ipv6: fix headroom calculation in udp6_ufo_fragment 2013-12-08 07:29:23 -08:00
ipx hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
irda net: irda: using kzalloc() instead of kmalloc() to avoid strncpy() issue. 2013-05-19 15:10:47 -07:00
iucv Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-04-22 20:32:51 -04:00
key af_key: more info leaks in pfkey messages 2013-08-11 18:35:25 -07:00
l2tp l2tp: must disable bh before calling l2tp_xmit_skb() 2013-11-04 04:31:02 -08:00
lapb
llc llc: Fix missing msg_namelen update in llc_ui_recvmsg() 2013-04-07 16:28:01 -04:00
mac80211 mac80211: fix crash if bitrate calculation goes wrong 2013-11-13 12:05:30 +09:00
mac802154 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-04-30 03:55:20 -04:00
netfilter netfilter: nf_conntrack: fix rt6i_gateway checks for H.323 helper 2013-11-04 04:31:05 -08:00
netlabel netlabel: improve domain mapping validation 2013-05-19 14:49:55 -07:00
netlink genl: Hold reference on correct module while netlink-dump. 2013-09-14 06:54:55 -07:00
netrom netrom: info leak in ->getname() 2013-04-25 01:47:58 -04:00
nfc NFC: llcp: Fix non blocking sockets connections 2013-08-29 09:47:30 -07:00
openvswitch openvswitch: Remove unneeded ovs_netdev_get_ifindex() 2013-04-30 00:19:11 -04:00
packet packet: restore packet statistics tp_packets to include drops 2013-09-14 06:54:55 -07:00
phonet rtnetlink: Remove passing of attributes into rtnl_doit functions 2013-03-22 10:31:16 -04:00
rds net/rds: zero last byte for strncpy 2013-03-08 00:35:44 -05:00
rfkill Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next 2013-04-22 14:58:14 -04:00
rose rose: fix info leak via msg_name in rose_recvmsg() 2013-04-07 16:28:02 -04:00
rxrpc Driver core patches for 3.9-rc1 2013-02-21 12:05:51 -08:00
sched net_sched: htb: fix a typo in htb_change_class() 2013-10-13 16:08:29 -07:00
sctp sctp: Perform software checksum if packet has to be fragmented. 2013-11-04 04:31:04 -08:00
sunrpc SUNRPC: Fix a data corruption issue when retransmitting RPC calls 2013-11-29 11:11:52 -08:00
tipc tipc: set sk_err correctly when connection fails 2013-09-14 06:54:56 -07:00
unix net: unix: inherit SOCK_PASS{CRED, SEC} flags from socket to fix race 2013-11-04 04:31:04 -08:00
vmw_vsock Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-04-30 03:55:20 -04:00
wimax
wireless cfg80211: fix scheduled scan pointer access 2013-12-04 10:57:30 -08:00
x25 x25: Fix broken locking in ioctl error paths. 2013-07-28 16:29:45 -07:00
xfrm xfrm: force a garbage collection after deleting a policy 2013-05-31 17:30:07 -07:00
compat.c net: heap overflow in __audit_sockaddr() 2013-11-04 04:31:00 -08:00
Kconfig netlink: kconfig: move mmap i/o into netlink kconfig 2013-05-01 15:02:42 -04:00
Makefile
nonet.c
socket.c net: heap overflow in __audit_sockaddr() 2013-11-04 04:31:00 -08:00
sysctl_net.c net: Update the sysctl permissions handler to test effective uid/gid 2013-10-13 16:08:34 -07:00