Pablo Neira Ayuso e3e608cbad netfilter: nft_payload: sanitize offset and length before calling skb_checksum() ...

[ Upstream commit d5953d680f ]

If access to offset + length is larger than the skbuff length, then
skb_checksum() triggers BUG_ON().

skb_checksum() internally subtracts the length parameter while iterating
over skbuff, BUG_ON(len) at the end of it checks that the expected
length to be included in the checksum calculation is fully consumed.

Fixes: 7ec3f7b47b ("netfilter: nft_payload: add packet mangling support")
Reported-by: Slavin Liu <slavin-ayu@qq.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-11-08 16:22:02 +01:00

..

6lowpan

…

9p

…

802

…

8021q

gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers

2024-09-12 11:06:47 +02:00

appletalk

…

atm

…

ax25

…

batman-adv

batman-adv: Don't accept TT entries for out-of-spec VIDs

2024-07-05 09:12:54 +02:00

bluetooth

Bluetooth: bnep: fix wild-memory-access in proto_unregister

2024-11-08 16:21:58 +01:00

bpf

…

bpfilter

…

bridge

netfilter: br_netfilter: fix panic with metadata_dst skb

2024-10-17 15:08:34 +02:00

caif

…

can

can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().

2024-10-17 15:07:41 +02:00

ceph

libceph: fix race between delayed_work() and ceph_monc_stop()

2024-07-18 13:05:49 +02:00

core

net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension

2024-11-08 16:22:02 +01:00

dcb

…

dccp

…

decnet

…

dns_resolver

…

dsa

…

ethernet

gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers

2024-09-12 11:06:47 +02:00

ethtool

ethtool: check device is present when getting link settings

2024-09-04 13:17:46 +02:00

hsr

…

ieee802154

…

ife

…

ipv4

xfrm: respect ip protocols rules criteria when performing dst lookups

2024-11-08 16:21:59 +01:00

ipv6

xfrm: respect ip protocols rules criteria when performing dst lookups

2024-11-08 16:21:59 +01:00

iucv

s390/iucv: fix receive buffer virtual vs physical address confusion

2024-09-04 13:17:38 +02:00

kcm

kcm: Serialise kcm_sendmsg() for the same socket.

2024-09-04 13:17:40 +02:00

key

…

l2tp

genetlink: hold RCU in genlmsg_mcast()

2024-11-08 16:21:57 +01:00

l3mdev

net: Add l3mdev index to flow struct and avoid oif reset for port devices

2024-10-17 15:08:35 +02:00

lapb

…

llc

…

mac80211

mac80211: Add support to trigger sta disconnect on hardware restart

2024-11-08 16:22:01 +01:00

mac802154

net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()

2024-07-27 10:40:21 +02:00

mpls

…

mptcp

mptcp: handle consistently DSS corruption

2024-10-22 15:39:29 +02:00

ncsi

net/ncsi: Fix the multi thread manner of NCSI driver

2024-07-05 09:12:22 +02:00

netfilter

netfilter: nft_payload: sanitize offset and length before calling skb_checksum()

2024-11-08 16:22:02 +01:00

netlabel

…

netlink

genetlink: hold RCU in genlmsg_mcast()

2024-11-08 16:21:57 +01:00

netrom

netrom: Fix a memory leak in nr_heartbeat_expiry()

2024-07-05 09:12:37 +02:00

nfc

…

nsh

…

openvswitch

…

packet

af_packet: Handle outgoing VLAN packets without hardware offloading

2024-08-19 05:40:55 +02:00

phonet

…

psample

…

qrtr

net: qrtr: Update packets cloning when broadcasting

2024-10-17 15:07:58 +02:00

rds

net:rds: Fix possible deadlock in rds_message_put

2024-09-04 13:17:45 +02:00

rfkill

…

rose

…

rxrpc

…

sched

net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT

2024-11-08 16:22:01 +01:00

sctp

sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start

2024-10-17 15:08:35 +02:00

smc

net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid

2024-11-08 16:21:57 +01:00

strparser

…

sunrpc

net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket

2024-09-12 11:06:51 +02:00

switchdev

…

tipc

tipc: guard against string buffer overrun

2024-10-17 15:08:11 +02:00

tls

…

unix

af_unix: Remove put_pid()/put_cred() in copy_peercred().

2024-09-12 11:06:45 +02:00

vmw_vsock

…

wimax

…

wireless

genetlink: hold RCU in genlmsg_mcast()

2024-11-08 16:21:57 +01:00

x25

…

xdp

…

xfrm

xfrm: validate new SA's prefixlen using SA family when sel.family is unset

2024-11-08 16:22:00 +01:00

compat.c

…

devres.c

…

Kconfig

…

Makefile

…

socket.c

…

sysctl_net.c

…