Ziyang Xuan a54ec573d9 ipv4: Fix potential uninit variable access bug in __ip_make_skb() ...

[ Upstream commit 99e5acae19 ]

Like commit ea30388bae ("ipv6: Fix an uninit variable access bug in
__ip6_make_skb()"). icmphdr does not in skb linear region under the
scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will
trigger the uninit variable access bug.

Use a local variable icmp_type to carry the correct value in different
scenarios.

Fixes: 96793b4825 ("[IPV4]: Add ICMPMsgStats MIB (RFC 4293)")
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-05-11 23:00:31 +09:00

..

bpfilter

…

netfilter

netfilter: tproxy: fix deadlock due to missing BH disable

2023-03-17 08:48:55 +01:00

af_inet.c

tcp/udp: Make early_demux back namespacified.

2022-11-10 18:15:38 +01:00

ah4.c

…

arp.c

ipv4: Invalidate neighbour for broadcast address upon address addition

2022-04-13 20:59:05 +02:00

bpf_tcp_ca.c

…

cipso_ipv4.c

cipso: Fix data-races around sysctl.

2022-07-21 21:24:21 +02:00

datagram.c

udp: Update reuse->has_conns under reuseport_lock.

2022-10-29 10:12:56 +02:00

devinet.c

net: Fix data-races around sysctl_devconf_inherit_init_net.

2022-08-31 17:16:44 +02:00

esp4_offload.c

xfrm: replay: Fix ESN wrap around for GSO

2022-12-02 17:41:02 +01:00

esp4.c

esp: limit skb_page_frag_refill use to a single page

2022-04-27 14:38:52 +02:00

fib_frontend.c

ipv4: Fix incorrect table ID in IOCTL path

2023-03-22 13:31:28 +01:00

fib_lookup.h

ipv4: fix data races in fib_alias_hw_flags_set

2022-02-23 12:03:10 +01:00

fib_notifier.c

…

fib_rules.c

…

fib_semantics.c

ipv4: prevent potential spectre v1 gadget in fib_metrics_match()

2023-02-01 08:27:27 +01:00

fib_trie.c

ipv4: Fix error return code in fib_table_insert()

2022-12-02 17:41:07 +01:00

fou.c

…

gre_demux.c

…

gre_offload.c

…

icmp.c

icmp: guard against too small mtu

2023-04-13 16:48:18 +02:00

igmp.c

igmp: Fix data-races around sysctl_igmp_qrv.

2022-08-03 12:03:48 +02:00

inet_connection_sock.c

tcp: Fix listen() regression in 5.15.88.

2023-02-22 12:57:06 +01:00

inet_diag.c

inet_diag: fix kernel-infoleak for UDP sockets

2021-12-22 09:32:40 +01:00

inet_fragment.c

inet: frags: annotate races around fqdir->dead and fqdir->high_thresh

2022-01-27 11:05:35 +01:00

inet_hashtables.c

inet: fix fast path in __inet_hash_connect()

2023-03-10 09:39:48 +01:00

inet_timewait_sock.c

tcp: avoid the lookup process failing to get sk in ehash table

2023-02-01 08:27:13 +01:00

inetpeer.c

inetpeer: Fix data-races around sysctl.

2022-07-21 21:24:21 +02:00

ip_forward.c

ip: Fix data-races around sysctl_ip_fwd_update_priority.

2022-07-29 17:25:13 +02:00

ip_fragment.c

inet: frags: annotate races around fqdir->dead and fqdir->high_thresh

2022-01-27 11:05:35 +01:00

ip_gre.c

erspan: do not use skb_mac_header() in ndo_start_xmit()

2023-03-30 12:47:48 +02:00

ip_input.c

xfrm: fix "disable_policy" on ipv4 early demux

2022-12-02 17:41:02 +01:00

ip_options.c

…

ip_output.c

ipv4: Fix potential uninit variable access bug in __ip_make_skb()

2023-05-11 23:00:31 +09:00

ip_sockglue.c

net: Fix data-races around sysctl_optmem_max.

2022-08-31 17:16:43 +02:00

ip_tunnel_core.c

tunnels: do not assume mac header is set in skb_tunnel_check_pmtu()

2022-07-07 17:53:29 +02:00

ip_tunnel.c

net: tunnels: annotate lockless accesses to dev->needed_headroom

2023-03-22 13:31:26 +01:00

ip_vti.c

…

ipcomp.c

…

ipconfig.c

…

ipip.c

…

ipmr_base.c

…

ipmr.c

ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path

2022-02-16 12:56:29 +01:00

Kconfig

tcp: configurable source port perturb table size

2022-12-02 17:41:11 +01:00

Makefile

…

metrics.c

ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()

2023-02-01 08:27:27 +01:00

netfilter.c

…

netlink.c

…

nexthop.c

nh: fix scope used to find saddr when adding non gw nh

2022-11-03 23:59:19 +09:00

ping.c

ping: fix address binding wrt vrf

2022-05-18 10:26:57 +02:00

proc.c

ip: Fix data-races around sysctl_ip_default_ttl.

2022-07-29 17:25:09 +02:00

protocol.c

…

raw_diag.c

…

raw.c

ipv4: raw: lock the socket in raw_bind()

2022-02-01 17:27:14 +01:00

route.c

ipv4: Fix data-races around sysctl_fib_multipath_hash_fields.

2022-07-29 17:25:21 +02:00

syncookies.c

mptcp: remove MPTCP 'ifdef' in TCP SYN cookies

2023-01-12 11:58:52 +01:00

sysctl_net_ipv4.c

tcp: restrict net.ipv4.tcp_app_win

2023-04-20 12:13:53 +02:00

tcp_bbr.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_bic.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_bpf.c

bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()

2023-03-17 08:48:54 +01:00

tcp_cdg.c

tcp: cdg: allow tcp_cdg_release() to be called multiple times

2022-11-26 09:24:50 +01:00

tcp_cong.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_cubic.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_dctcp.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_dctcp.h

…

tcp_diag.c

…

tcp_fastopen.c

tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout.

2022-07-29 17:25:19 +02:00

tcp_highspeed.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_htcp.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_hybla.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_illinois.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_input.c

tcp: fix indefinite deferral of RTO with SACK reneging

2022-11-03 23:59:17 +09:00

tcp_ipv4.c

bpf: tcp: Use sock_gen_put instead of sock_put in bpf_iter_tcp

2023-04-20 12:13:53 +02:00

tcp_lp.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_metrics.c

tcp: Fix data-races around sysctl_tcp_no_ssthresh_metrics_save.

2022-08-03 12:03:45 +02:00

tcp_minisocks.c

tcp: tcp_check_req() can be called from process context

2023-03-11 13:57:30 +01:00

tcp_nv.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_offload.c

…

tcp_output.c

tcp: tcp_make_synack() can be called from process context

2023-03-22 13:31:23 +01:00

tcp_rate.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_recovery.c

tcp: Fix data-races around sysctl_tcp_recovery.

2022-07-29 17:25:22 +02:00

tcp_scalable.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_timer.c

tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.

2022-07-29 17:25:22 +02:00

tcp_ulp.c

net/ulp: use consistent error code when blocking ULP

2023-01-24 07:22:48 +01:00

tcp_vegas.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_vegas.h

…

tcp_veno.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_westwood.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp_yeah.c

tcp: add accessors to read/set tp->snd_cwnd

2022-06-14 18:36:11 +02:00

tcp.c

tcp: fix rate_app_limited to default to 1

2023-02-01 08:27:16 +01:00

tunnel4.c

…

udp_bpf.c

bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()

2023-03-17 08:48:54 +01:00

udp_diag.c

…

udp_impl.h

…

udp_offload.c

…

udp_tunnel_core.c

net/tunnel: wait until all sk_user_data reader finish before releasing the sock

2022-12-31 13:14:19 +01:00

udp_tunnel_nic.c

udp_tunnel: Fix end of loop test in udp_tunnel_nic_unregister()

2022-03-02 11:47:59 +01:00

udp_tunnel_stub.c

…

udp.c

tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().

2023-04-26 13:51:54 +02:00

udplite.c

tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().

2023-04-26 13:51:54 +02:00

xfrm4_input.c

…

xfrm4_output.c

…

xfrm4_policy.c

…

xfrm4_protocol.c

net: xfrm: unexport __init-annotated xfrm4_protocol_init()

2022-06-14 18:36:18 +02:00

xfrm4_state.c

…

xfrm4_tunnel.c

…