Sabrina Dubroca 3cb00b90e8 net: add recursion limit to GRO ... [ Upstream commit fcd91dd449 ] Currently, GRO can do unlimited recursion through the gro_receive handlers. This was fixed for tunneling protocols by limiting tunnel GRO to one level with encap_mark, but both VLAN and TEB still have this problem. Thus, the kernel is vulnerable to a stack overflow, if we receive a packet composed entirely of VLAN headers. This patch adds a recursion counter to the GRO layer to prevent stack overflow. When a gro_receive function hits the recursion limit, GRO is aborted for this skb and it is processed normally. This recursion counter is put in the GRO CB, but could be turned into a percpu counter if we run out of space in the CB. Thanks to Vladimír Beneš <vbenes@redhat.com> for the initial bug report. Fixes: CVE-2016-7039 Fixes: 9b174d88c2 ("net: Add Transparent Ethernet Bridging GRO support.") Fixes: 66e5133f19 ("vlan: Add GRO support for non hardware accelerated vlan") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Jiri Benc <jbenc@redhat.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Acked-by: Tom Herbert <tom@herbertland.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2016-11-15 07:46:38 +01:00
..
acpi	Merge branch 'acpi-pci'	2015-11-07 01:30:10 +01:00
asm-generic	asm-generic: make copy_from_user() zero the destination properly	2016-09-24 10:07:45 +02:00
clocksource
crypto	crypto: ghash-generic - move common definitions to a new header file	2016-10-22 12:26:56 +02:00
drm	drm/prime: Pass the right module owner through to dma_buf_export()	2016-10-31 04:13:57 -06:00
dt-bindings	ARM: DT updates for v4.4	2015-11-10 15:06:26 -08:00
keys
kvm	KVM: arm/arm64: arch_timer: Preserve physical dist. active state on LR.active	2015-11-24 18:07:40 +01:00
linux	net: add recursion limit to GRO	2016-11-15 07:46:38 +01:00
math-emu
media	videobuf2-core: Check user space planes array in dqbuf	2016-05-04 14:48:50 -07:00
memory
misc
net	net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions	2016-11-15 07:46:37 +01:00
pcmcia
ras
rdma	IB/security: Restrict use of the write() interface	2016-05-04 14:48:48 -07:00
rxrpc
scsi	scsi: Add intermediate STARGET_REMOVE state to scsi_target_state	2016-06-01 12:15:54 -07:00
soc	ARM: SoC driver updates for v4.4	2015-11-10 15:00:03 -08:00
sound	ALSA: rawmidi: Make snd_rawmidi_transmit() race-free	2016-02-17 12:30:58 -08:00
target	target: Make EXTENDED_COPY 0xe4 failure return COPY TARGET DEVICE NOT REACHABLE	2016-10-28 03:01:36 -04:00
trace	SUNRPC: Don't allocate a full sockaddr_storage for tracing	2016-08-20 18:09:26 +02:00
uapi	rtnetlink: Add rtnexthop offload flag to compare mask	2016-11-15 07:46:38 +01:00
video	drm/imx: Match imx-ipuv3-crtc components using device node in platform data	2016-06-07 18:14:37 -07:00
xen	xen: Fix page <-> pfn conversion on 32 bit systems	2016-05-11 11:21:14 +02:00
Kbuild