Ren Wei 9d3f027327 netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() ...

Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS.

rt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[].
Validate addrnr during rule installation so malformed rules are rejected
before the match logic can use an out-of-range value.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Yuhang Zheng <z1652074432@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2026-03-26 13:18:31 +01:00

..

ila

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

netfilter

netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()

2026-03-26 13:18:31 +01:00

addrconf_core.c

…

addrconf.c

ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.

2026-03-23 16:59:31 -07:00

addrlabel.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

af_inet6.c

ipv6: move the disable_ipv6_mod knob to core code

2026-03-11 17:53:37 -07:00

ah6.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

anycast.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

calipso.c

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

datagram.c

ipv6: use inet->cork.fl.u.ip6 and np->final in ip6_datagram_dst_update()

2026-02-10 20:57:49 -08:00

esp6_offload.c

xfrm: Fix inner mode lookup in tunnel mode GSO segmentation

2025-12-04 09:54:53 +01:00

esp6.c

esp: fix skb leak with espintcp and async crypto

2026-02-25 09:11:40 +01:00

exthdrs_core.c

…

exthdrs_offload.c

…

exthdrs.c

ipv6: add NULL checks for idev in SRv6 paths

2026-03-18 17:23:43 -07:00

fib6_notifier.c

…

fib6_rules.c

…

fou6.c

…

icmp.c

ipv6: icmp: icmpv6_xrlim_allow() optimization if net.ipv6.icmp.ratelimit is zero

2026-02-18 16:46:37 -08:00

inet6_connection_sock.c

tcp: inet6_csk_xmit() optimization

2026-02-10 20:57:50 -08:00

inet6_hashtables.c

inet: annotate data-races around isk->inet_num

2026-02-27 17:16:59 -08:00

ioam6_iptunnel.c

ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()

2026-02-13 12:24:05 -08:00

ioam6.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ip6_checksum.c

…

ip6_fib.c

ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.

2026-03-23 16:59:31 -07:00

ip6_flowlabel.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ip6_gre.c

ipv6: use dst6_mtu() instead of dst_mtu()

2026-02-02 17:49:29 -08:00

ip6_icmp.c

icmp: fix icmp_ndo_send address translation for reply direction

2025-09-01 12:54:41 -07:00

ip6_input.c

net/ipv6: Introduce payload_len helpers

2026-02-06 20:50:03 -08:00

ip6_offload.c

net/ipv6: Remove jumbo_remove step from TX path

2026-02-06 20:50:12 -08:00

ip6_offload.h

…

ip6_output.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

ip6_tunnel.c

ipv6: use dst6_mtu() instead of dst_mtu()

2026-02-02 17:49:29 -08:00

ip6_udp_tunnel.c

net: Convert proto_ops connect() callbacks to use sockaddr_unsized

2025-11-04 19:10:32 -08:00

ip6_vti.c

…

ip6mr.c

…

ipcomp6.c

…

ipv6_sockglue.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

Kconfig

ipv6: sr: Use HMAC-SHA1 and HMAC-SHA256 library functions

2025-08-26 18:11:29 -07:00

Makefile

gro: inline tcp6_gro_receive()

2026-01-21 19:28:32 -08:00

mcast_snoop.c

…

mcast.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

mip6.c

…

ndisc.c

ipv6: annotate data-race in ndisc_router_discovery()

2026-01-20 18:37:45 -08:00

netfilter.c

…

output_core.c

net/ipv6: Introduce payload_len helpers

2026-02-06 20:50:03 -08:00

ping.c

net: Convert proto callbacks from sockaddr to sockaddr_unsized

2025-11-04 19:10:33 -08:00

proc.c

ipv6: snmp: do not track per idev ICMP6_MIB_RATELIMITHOST

2025-09-08 18:06:20 -07:00

protocol.c

…

raw.c

ipv6: do not use skb_header_pointer() in icmpv6_filter()

2026-02-06 20:34:20 -08:00

reassembly.c

…

route.c

ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.

2026-03-23 16:59:31 -07:00

rpl_iptunnel.c

…

rpl.c

…

seg6_hmac.c

ipv6: add NULL checks for idev in SRv6 paths

2026-03-18 17:23:43 -07:00

seg6_iptunnel.c

…

seg6_local.c

…

seg6.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

sit.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

syncookies.c

tcp: secure_seq: add back ports to TS offset

2026-03-04 17:44:35 -08:00

sysctl_net_ipv6.c

…

tcp_ao.c

…

tcp_ipv6.c

tcp: secure_seq: add back ports to TS offset

2026-03-04 17:44:35 -08:00

tcpv6_offload.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-01-29 17:28:54 -08:00

tunnel6.c

…

udp_impl.h

…

udp_offload.c

gro: inline tcp6_gro_complete()

2026-01-21 19:28:32 -08:00

udp.c

udp: udplite is unlikely

2026-01-06 17:06:03 -08:00

udplite.c

udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb().

2026-02-20 16:14:10 -08:00

xfrm6_input.c

…

xfrm6_output.c

…

xfrm6_policy.c

xfrm6: fix uninitialized saddr in xfrm6_get_saddr()

2026-02-02 08:03:47 +01:00

xfrm6_protocol.c

…

xfrm6_state.c

…

xfrm6_tunnel.c

…