Eric Dumazet 96296cddf9 netlabel: out of bound access in cipso_v4_validate() ...

commit d71b7896886345c53ef1d84bda2bc758554f5d61 upstream.

syzkaller found another out of bound access in ip_options_compile(),
or more exactly in cipso_v4_validate()

Fixes: 20e2a86485 ("cipso: handle CIPSO options correctly when NetLabel is disabled")
Fixes: 446fda4f26 ("[NetLabel]: CIPSOv4 engine")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov  <dvyukov@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>

2017-06-08 00:46:58 +02:00

..

9p

9p: turn fid->dlist into hlist

2013-02-27 22:51:08 -05:00

bluetooth

Bluetooth: Introduce a new HCI_RFKILLED flag

2013-10-13 16:08:32 -07:00

caif

caif: Remove my bouncing email address.

2013-04-23 13:25:51 -04:00

irda

irda: small read past the end of array in debug code

2013-04-19 17:32:31 -04:00

iucv

af_iucv: fix recvmsg by replacing skb_pull() function

2013-04-08 17:16:57 -04:00

netfilter

netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len

2014-05-30 21:52:11 -07:00

netns

sctp: fix ASCONF list handling

2015-10-01 12:07:34 +02:00

nfc

NFC: RFKILL support

2013-04-12 16:54:45 +02:00

phonet

…

sctp

sctp: fix ASCONF list handling

2015-10-01 12:07:34 +02:00

tc_act

…

act_api.h

act_police: move struct tcf_police to act_police.c

2013-02-12 18:59:45 -05:00

addrconf.h

IPv6 NAT: Do not drop DNATed 6to4/6rd packets

2013-10-13 16:08:30 -07:00

af_ieee802154.h

…

af_rxrpc.h

…

af_unix.h

unix: correctly track in-flight fds in sending process user_struct

2016-03-03 15:06:20 -08:00

ah.h

…

arp.h

…

atmclip.h

…

ax25.h

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

ax88796.h

…

cfg80211-wext.h

…

cfg80211.h

cfg80211: introduce critical protocol indication from user-space

2013-04-22 15:48:00 +02:00

checksum.h

…

cipso_ipv4.h

netlabel: out of bound access in cipso_v4_validate()

2017-06-08 00:46:58 +02:00

cls_cgroup.h

cls_cgroup: remove task_struct parameter from sock_update_classid()

2013-04-09 13:19:35 -04:00

codel.h

…

compat.h

…

datalink.h

…

dcbevent.h

…

dcbnl.h

…

dn_dev.h

…

dn_fib.h

decnet: Parse netlink attributes on our own

2013-03-22 10:31:16 -04:00

dn_neigh.h

…

dn_nsp.h

…

dn_route.h

decnet: use correct RCU API to deref sk_dst_cache field

2013-01-28 00:15:27 -05:00

dn.h

…

dsa.h

…

dsfield.h

ipv6: Optimize ipv6_change_dsfield().

2013-01-09 23:59:53 -08:00

dst_ops.h

…

dst.h

net: dst: provide accessor function to dst->xfrm

2013-11-04 04:31:03 -08:00

esp.h

…

ethoc.h

…

fib_rules.h

…

firewire.h

firewire net, ipv4 arp: Extend hardware address and remove driver-level packet inspection.

2013-03-26 12:32:13 -04:00

flow_keys.h

flow_keys: include thoff into flow_keys for later usage

2013-03-20 12:14:36 -04:00

flow.h

…

garp.h

…

gen_stats.h

…

genetlink.h

genl: Hold reference on correct module while netlink-dump.

2013-09-14 06:54:55 -07:00

gre.h

GRE: Refactor GRE tunneling code.

2013-03-26 12:27:18 -04:00

gro_cells.h

gro: Fix kcalloc argument order

2013-01-27 22:46:33 -05:00

icmp.h

ipv4: fix error handling in icmp_protocol.

2013-02-22 15:10:18 -05:00

ieee80211_radiotap.h

…

ieee802154_netdev.h

ieee802154/nl-mac.c: make some MLME operations optional

2013-04-08 12:00:16 -04:00

ieee802154.h

…

if_inet6.h

ipv6: move DAD and addrconf_verify processing to workqueue

2017-02-10 11:03:42 +01:00

inet6_connection_sock.h

…

inet6_hashtables.h

ipv6: use a stronger hash for tcp

2013-02-21 18:15:58 -05:00

inet_common.h

net: avoid NULL deref in inet_ctl_sock_destroy()

2015-12-09 13:40:06 -05:00

inet_connection_sock.h

tcp: fix tcp_release_cb() to dispatch via address family for mtu_reduced()

2014-10-15 08:31:56 +02:00

inet_ecn.h

…

inet_frag.h

net: frag, fix race conditions in LRU list maintenance

2013-05-06 11:06:51 -04:00

inet_hashtables.h

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

inet_sock.h

ipv6: use a stronger hash for tcp

2013-02-21 18:15:58 -05:00

inet_timewait_sock.h

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

inetpeer.h

inetpeer: get rid of ip_id_count

2014-08-14 09:24:15 +08:00

ip6_checksum.h

ipv6: move csum_ipv6_magic() and udp6_csum_init() into static library

2013-01-08 17:56:10 -08:00

ip6_fib.h

ipv6: prevent fib6_run_gc() contention

2015-07-03 19:48:09 -07:00

ip6_route.h

ipv6: Limit mtu to 65575 bytes

2014-05-30 21:52:14 -07:00

ip6_tunnel.h

ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()

2017-02-10 11:03:44 +01:00

ip_fib.h

ipv4: fix definition of FIB_TABLE_HASHSZ

2013-03-13 10:47:09 -04:00

ip_tunnels.h

ip_gre: Fix WCCPv2 header parsing.

2013-11-20 12:27:46 -08:00

ip_vs.h

netfilter: push reasm skb through instead of original frag skbs

2013-12-08 07:29:25 -08:00

ip.h

ipv6: lock socket in ip6_datagram_connect()

2015-10-01 12:07:37 +02:00

ipcomp.h

…

ipconfig.h

…

ipv6.h

ipv6: distinguish frag queues by device for multicast and link-local packets

2016-01-22 19:47:52 -08:00

ipx.h

…

iw_handler.h

…

lapb.h

…

lib80211.h

hostap: Don't use create_proc_read_entry()

2013-04-29 15:41:56 -04:00

llc_c_ac.h

…

llc_c_ev.h

…

llc_c_st.h

…

llc_conn.h

…

llc_if.h

…

llc_pdu.h

…

llc_s_ac.h

…

llc_s_ev.h

…

llc_s_st.h

…

llc_sap.h

…

llc.h

…

mac80211.h

mac80211: add a flag to indicate CCK support for HT clients

2013-09-07 22:09:59 -07:00

mac802154.h

…

mip6.h

…

mld.h

…

mrp.h

net/802: Implement Multiple Registration Protocol (MRP)

2013-02-10 20:37:22 -05:00

ndisc.h

ipv6: don't call fib6_run_gc() until routing is ready

2017-02-10 11:03:42 +01:00

neighbour.h

net neighbour, decnet: Ensure to align device private data on preferred alignment.

2013-02-11 00:21:44 -05:00

net_namespace.h

netfilter: make /proc/net/netfilter pernet

2013-04-05 19:35:02 +02:00

net_ratelimit.h

…

netdma.h

…

netevent.h

ipv6 netevent: Remove old_neigh from netevent_redirect.

2013-01-14 15:04:59 -05:00

netlabel.h

…

netlink.h

…

netprio_cgroup.h

netprio_cgroup: remove task_struct parameter from sock_update_netprio()

2013-04-09 13:19:37 -04:00

netrom.h

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

nexthop.h

…

nl802154.h

…

p8022.h

…

ping.h

…

pkt_cls.h

pkt_sched: namespace aware act_mirred

2013-01-14 15:09:36 -05:00

pkt_sched.h

sch_api: introduce qdisc_watchdog_schedule_ns()

2013-02-12 18:59:45 -05:00

protocol.h

…

psnap.h

…

raw.h

…

rawv6.h

…

red.h

…

regulatory.h

regulatory: use RCU to protect last_request

2013-01-03 13:01:30 +01:00

request_sock.h

net: remove a stale comment for dl_next

2013-04-22 15:55:48 -04:00

rose.h

…

route.h

…

rtnetlink.h

rtnetlink: Remove passing of attributes into rtnl_doit functions

2013-03-22 10:31:16 -04:00

sch_generic.h

net_sched: restore "linklayer atm" handling

2013-09-14 06:54:55 -07:00

scm.h

unix: correctly track in-flight fds in sending process user_struct

2016-03-03 15:06:20 -08:00

secure_seq.h

inetpeer: get rid of ip_id_count

2014-08-14 09:24:15 +08:00

slhc_vj.h

…

snmp.h

…

sock.h

net: avoid sk_forward_alloc overflows

2017-02-10 11:03:52 +01:00

stp.h

…

tcp_memcontrol.h

…

tcp_states.h

…

tcp.h

tcp: take care of truncations done by sk_filter()

2017-02-10 11:03:46 +01:00

timewait_sock.h

…

transp_v6.h

ipv6: rename datagram_send_ctl and datagram_recv_ctl

2013-01-31 13:53:08 -05:00

udp.h

ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data

2013-07-28 16:29:49 -07:00

udplite.h

…

wext.h

…

wimax.h

…

wpan-phy.h

…

x25.h

…

x25device.h

…

xfrm.h

xfrm: force a garbage collection after deleting a policy

2013-05-31 17:30:07 -07:00