Florian Westphal 84ed07d957 netfilter: ipv6: fix oops when defragmenting locally generated fragments ...

[ Upstream commit 61792b6774 ]

Unlike ipv4 and normal ipv6 defrag, netfilter ipv6 defragmentation did
not save/restore skb->dst.

This causes oops when handling locally generated ipv6 fragments, as
output path needs a valid dst.

Reported-by: Maciej Żenczykowski <zenczykowski@gmail.com>
Fixes: 84379c9afe ("netfilter: ipv6: nf_defrag: drop skb dst before queueing")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2018-11-27 16:13:01 +01:00

..

ila

ila: remove blank lines at EOF

2018-07-24 14:10:42 -07:00

netfilter

netfilter: ipv6: fix oops when defragmenting locally generated fragments

2018-11-27 16:13:01 +01:00

addrconf_core.c

net/ipv6: Add helper to return path MTU based on fib result

2018-05-22 10:51:09 +02:00

addrconf.c

net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs

2018-10-20 15:43:14 -07:00

addrlabel.c

…

af_inet6.c

ipv6: fix cleanup ordering for pingv6 registration

2018-08-29 19:28:55 -07:00

ah6.c

…

anycast.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2018-06-06 18:39:49 -07:00

calipso.c

ipv6: make ipv6_renew_options() interrupt/kernel safe

2018-07-05 20:15:26 +09:00

datagram.c

net: add helpers checking if socket can be bound to nonlocal address

2018-08-01 09:50:04 -07:00

esp6_offload.c

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

2018-07-27 09:33:37 -07:00

esp6.c

esp6: fix memleak on error path in esp6_input

2018-06-27 17:32:11 +02:00

exthdrs_core.c

…

exthdrs_offload.c

…

exthdrs.c

ipv6: make ipv6_renew_options() interrupt/kernel safe

2018-07-05 20:15:26 +09:00

fib6_notifier.c

…

fib6_rules.c

…

fou6.c

…

icmp.c

ipv6: Add icmp_echo_ignore_all support for ICMPv6

2018-08-13 08:42:25 -07:00

inet6_connection_sock.c

…

inet6_hashtables.c

bpf: Enable BPF_PROG_TYPE_SK_REUSEPORT bpf prog in reuseport selection

2018-08-11 01:58:46 +02:00

ip6_checksum.c

net: udp: fix handling of CHECKSUM_COMPLETE packets

2018-11-04 14:50:51 +01:00

ip6_fib.c

net/ipv6: stop leaking percpu memory in fib6 info

2018-10-10 22:42:54 -07:00

ip6_flowlabel.c

ipv6: fold sockcm_cookie into ipcm6_cookie

2018-07-07 10:58:49 +09:00

ip6_gre.c

erspan: set erspan_ver to 1 by default when adding an erspan dev

2018-08-27 15:13:17 -07:00

ip6_icmp.c

…

ip6_input.c

net: ipv6: listify ipv6_rcv() and ip6_rcv_finish()

2018-07-06 11:19:07 +09:00

ip6_offload.c

gso_segment: Reset skb->mac_len after modifying network header

2018-09-13 12:09:32 -07:00

ip6_offload.h

…

ip6_output.c

ipv6: fix possible use-after-free in ip6_xmit()

2018-09-17 07:56:02 -07:00

ip6_tunnel.c

ip6_tunnel: Fix encapsulation layout

2018-10-18 16:54:40 -07:00

ip6_udp_tunnel.c

…

ip6_vti.c

vti6: remove !skb->ignore_df check from vti6_xmit()

2018-08-29 17:51:44 -07:00

ip6mr.c

rhashtable: split rhashtable.h

2018-06-22 13:43:27 +09:00

ipcomp6.c

…

ipv6_sockglue.c

Merge ra.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux

2018-07-20 21:17:12 -07:00

Kconfig

net: remove blank lines at end of file

2018-07-24 14:10:43 -07:00

Makefile

…

mcast_snoop.c

…

mcast.c

ipv6: mcast: fix a use-after-free in inet6_mc_check

2018-10-15 22:38:55 -07:00

mip6.c

…

ndisc.c

ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called

2018-11-04 14:50:51 +01:00

netfilter.c

netfilter: utils: move nf_ip6_checksum* from ipv6 to utils

2018-07-16 17:51:48 +02:00

output_core.c

…

ping.c

ipv6: fold sockcm_cookie into ipcm6_cookie

2018-07-07 10:58:49 +09:00

proc.c

…

protocol.c

…

raw.c

ipv6: take rcu lock in rawv6_send_hdrinc()

2018-10-05 14:45:34 -07:00

reassembly.c

ipv6: defrag: drop non-last frags smaller than min mtu

2018-08-05 17:21:14 -07:00

route.c

ipv6: Fix PMTU updates for UDP/raw sockets in presence of VRF

2018-11-23 08:17:02 +01:00

seg6_hmac.c

Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net

2018-07-03 10:29:26 +09:00

seg6_iptunnel.c

ipv6: sr: fix useless rol32 call on hash

2018-07-18 15:10:47 -07:00

seg6_local.c

bpf: add End.DT6 action to bpf_lwt_seg6_action helper

2018-07-31 09:22:48 +02:00

seg6.c

rhashtable: split rhashtable.h

2018-06-22 13:43:27 +09:00

sit.c

ip6_tunnel: remove magic mtu value 0xFFF8

2018-06-01 13:56:30 -04:00

syncookies.c

…

sysctl_net_ipv6.c

…

tcp_ipv6.c

net/ipv6: Fix linklocal to global address with VRF

2018-07-21 19:31:46 -07:00

tcpv6_offload.c

net: Convert GRO SKB handling to list_head.

2018-06-26 11:33:04 +09:00

tunnel6.c

…

udp_impl.h

…

udp_offload.c

net: Convert GRO SKB handling to list_head.

2018-06-26 11:33:04 +09:00

udp.c

udp6: fix encap return code for resubmitting

2018-10-17 22:26:53 -07:00

udplite.c

…

xfrm6_input.c

xfrm: reset transport header back to network header after all input transforms ahave been applied

2018-09-04 10:26:30 +02:00

xfrm6_mode_beet.c

…

xfrm6_mode_ro.c

ipv6: xfrm: use 64-bit timestamps

2018-07-11 15:26:35 +02:00

xfrm6_mode_transport.c

xfrm: reset transport header back to network header after all input transforms ahave been applied

2018-09-04 10:26:30 +02:00

xfrm6_mode_tunnel.c

…

xfrm6_output.c

xfrm6: call kfree_skb when skb is toobig

2018-09-03 07:37:57 +02:00

xfrm6_policy.c

net/xfrm: fix out-of-bounds packet access

2018-10-11 13:24:46 +02:00

xfrm6_protocol.c

…

xfrm6_state.c

…

xfrm6_tunnel.c

…