Willem de Bruijn dd7e1cbd26 gso: validate gso_type in GSO handlers ...

[ Upstream commit 121d57af30 ]

Validate gso_type during segmentation as SKB_GSO_DODGY sources
may pass packets where the gso_type does not match the contents.

Syzkaller was able to enter the SCTP gso handler with a packet of
gso_type SKB_GSO_TCPV4.

On entry of transport layer gso handlers, verify that the gso_type
matches the transport protocol.

Fixes: 90017accff ("sctp: Add GSO support")
Link: http://lkml.kernel.org/r/<001a1137452496ffc305617e5fe0@google.com>
Reported-by: syzbot+fee64147a25aecd48055@syzkaller.appspotmail.com
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-01-31 14:03:47 +01:00

..

ila

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

netfilter

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

addrconf_core.c

Ipvlan should return an error when an address is already in use.

2017-06-09 12:26:07 -04:00

addrconf.c

ipv6: set all.accept_dad to 0 by default

2018-01-02 20:31:13 +01:00

addrlabel.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

af_inet6.c

net: reevalulate autoflowlabel setting after sysctl setting

2018-01-02 20:31:06 +01:00

ah6.c

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

2017-06-23 14:17:31 -04:00

anycast.c

net, ipv6: convert ifacaddr6.aca_refcnt from atomic_t to refcount_t

2017-07-04 01:29:04 -07:00

calipso.c

net, calipso: convert calipso_doi.refcount from atomic_t to refcount_t

2017-07-04 22:35:16 +01:00

datagram.c

net: convert sock.sk_refcnt from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

esp6_offload.c

gso: validate gso_type in GSO handlers

2018-01-31 14:03:47 +01:00

esp6.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-09-01 17:42:05 -07:00

exthdrs_core.c

…

exthdrs_offload.c

…

exthdrs.c

ipv6: sr: fix TLVs not being copied using setsockopt

2018-01-17 09:45:23 +01:00

fib6_notifier.c

net: Add module reference to FIB notifiers

2017-09-01 20:33:42 -07:00

fib6_rules.c

net: ipv6: avoid overhead when no custom FIB rules are installed

2017-08-08 21:40:08 -07:00

fou6.c

…

icmp.c

ipv6: Use rt6i_idev index for echo replies to a local address

2017-08-29 15:32:25 -07:00

inet6_connection_sock.c

…

inet6_hashtables.c

net: ipv6: add second dif to inet6 socket lookups

2017-08-07 11:39:22 -07:00

ip6_checksum.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ip6_fib.c

ipv6: fix typo in fib6_net_exit()

2017-09-08 16:09:04 -07:00

ip6_flowlabel.c

ipv6: flowlabel: do not leave opt->tot_len with garbage

2017-10-22 03:22:24 +01:00

ip6_gre.c

ip6_gre: init dev->mtu and dev->hard_header_len correctly

2018-01-31 14:03:47 +01:00

ip6_icmp.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ip6_input.c

…

ip6_offload.c

gso: fix payload length when gso_size is zero

2017-10-08 10:12:15 -07:00

ip6_offload.h

…

ip6_output.c

ipv6: ip6_make_skb() needs to clear cork.base.dst

2018-01-31 14:03:45 +01:00

ip6_tunnel.c

ip6_tunnel: disable dst caching if tunnel is dual-stack

2018-01-17 09:45:20 +01:00

ip6_udp_tunnel.c

…

ip6_vti.c

vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit

2017-09-26 09:58:21 -07:00

ip6mr.c

rtnetlink: make rtnl_register accept a flags parameter

2017-08-09 16:57:38 -07:00

ipcomp6.c

…

ipv6_sockglue.c

ipv6: Fix getsockopt() for sockets with default IPV6_AUTOFLOWLABEL

2018-01-31 14:03:44 +01:00

Kconfig

ipv6: sr: add helper functions for seg6local

2017-08-25 17:10:24 -07:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

mcast_snoop.c

…

mcast.c

ipv6: mcast: better catch silly mtu values

2018-01-02 20:31:06 +01:00

mip6.c

…

ndisc.c

neigh: increase queue_len_bytes to match wmem_default

2017-08-29 16:10:50 -07:00

netfilter.c

…

output_core.c

net: accept UFO datagrams from tuntap and packet

2017-12-17 15:07:58 +01:00

ping.c

net: ping: do not abuse udp_poll()

2017-06-04 22:56:55 -04:00

proc.c

proc: snmp6: Use correct type in memset

2017-06-12 09:53:14 -04:00

protocol.c

…

raw.c

net: ipv6: add second dif to raw socket lookups

2017-08-07 11:39:22 -07:00

reassembly.c

Revert "net: fix percpu memory leaks"

2017-09-03 11:01:05 -07:00

route.c

ipv6: Honor specified parameters in fibmatch lookup

2018-01-02 20:31:11 +01:00

seg6_hmac.c

ipv6: sr: Use ARRAY_SIZE macro

2017-09-01 18:35:23 -07:00

seg6_iptunnel.c

ipv6: sr: add support for encapsulation of L2 frames

2017-08-25 17:10:23 -07:00

seg6_local.c

ipv6: sr: remove duplicate routing header type check

2017-09-11 14:34:10 -07:00

seg6.c

ipv6: sr: define core operations for seg6local lightweight tunnel

2017-08-07 14:16:22 -07:00

sit.c

sit: update frag_off info

2017-12-17 15:07:56 +01:00

syncookies.c

ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()

2017-07-18 11:22:51 -07:00

sysctl_net_ipv6.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

tcp_ipv6.c

tcp md5sig: Use skb's saddr when replying to an incoming segment

2018-01-02 20:31:07 +01:00

tcpv6_offload.c

gso: validate gso_type in GSO handlers

2018-01-31 14:03:47 +01:00

tunnel6.c

…

udp_impl.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

udp_offload.c

gso: validate gso_type in GSO handlers

2018-01-31 14:03:47 +01:00

udp.c

udpv6: Fix the checksum computation when HW checksum does not apply

2017-09-18 11:43:03 -07:00

udplite.c

…

xfrm6_input.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

xfrm6_mode_beet.c

networking: make skb_pull & friends return void pointers

2017-06-16 11:48:39 -04:00

xfrm6_mode_ro.c

ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()

2017-06-02 13:57:27 -04:00

xfrm6_mode_transport.c

ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()

2017-06-02 13:57:27 -04:00

xfrm6_mode_tunnel.c

…

xfrm6_output.c

…

xfrm6_policy.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

xfrm6_protocol.c

…

xfrm6_state.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

xfrm6_tunnel.c

net, ipv6: convert xfrm6_tunnel_spi.refcnt from atomic_t to refcount_t

2017-07-04 01:29:04 -07:00