Or Cohen acf69c9462 net/packet: fix overflow in tpacket_rcv ... Using tp_reserve to calculate netoff can overflow as tp_reserve is unsigned int and netoff is unsigned short. This may lead to macoff receving a smaller value then sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr is set, an out-of-bounds write will occur when calling virtio_net_hdr_from_skb. The bug is fixed by converting netoff to unsigned int and checking if it exceeds USHRT_MAX. This addresses CVE-2020-14386 Fixes: 8913336a7e ("packet: add PACKET_RESERVE sockopt") Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2020-09-04 11:56:02 -07:00
..
6lowpan
9p	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
802
8021q	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
appletalk
atm	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
ax25
batman-adv
bluetooth
bpf	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
bpfilter
bridge
caif	net: caif: fix error code handling	2020-08-25 07:50:25 -07:00
can	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
ceph	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
core	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-09-03 18:50:48 -07:00
dcb
dccp	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
decnet	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
dns_resolver
dsa	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
ethernet
ethtool
hsr
ieee802154	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
ife
ipv4	netfilter: delete repeated words	2020-08-28 20:11:38 +02:00
ipv6	ipv6: Fix sysctl max for fib_multipath_hash_policy	2020-09-02 15:44:53 -07:00
iucv	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
kcm
key
l2tp
l3mdev	net: Fix some comments	2020-08-27 07:55:59 -07:00
lapb
llc
mac80211	mac80211: reduce packet loss event false positives	2020-08-27 10:53:20 +02:00
mac802154
mpls	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
mptcp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-09-03 18:50:48 -07:00
ncsi	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-09-03 18:50:48 -07:00
netlabel	netlabel: fix problems with mapping removal	2020-08-24 16:08:00 -07:00
netlink	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-09-03 18:50:48 -07:00
netrom	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
nfc
nsh
openvswitch	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
packet	net/packet: fix overflow in tpacket_rcv	2020-09-04 11:56:02 -07:00
phonet	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
psample
qrtr
rds	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
rfkill
rose	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-09-03 18:50:48 -07:00
sched	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-09-03 18:50:48 -07:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-09-03 18:50:48 -07:00
smc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-09-03 18:50:48 -07:00
strparser
sunrpc	Fixes:	2020-08-25 18:01:36 -07:00
switchdev
tipc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-09-03 18:50:48 -07:00
tls
unix	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
vmw_vsock
wimax
wireless	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-09-03 18:50:48 -07:00
x25	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
xdp
xfrm	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
compat.c
devres.c
Kconfig
Makefile
socket.c	net: Fix some comments	2020-08-27 07:55:59 -07:00
sysctl_net.c