github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-07 19:16:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
26cc0e69cc
linux/net/ipv4
History
Yuqi Xu e47a1958e1 net: ipconfig: bound DHCP option construction 
ic_dhcp_init_options() appends the hostname (option 12), vendor-class
(option 60) and client-ID (option 61) options into the fixed 312-byte
bootp_pkt.exten[] buffer.  Only the client-ID branch checked the
remaining space; the hostname and vendor-class writes were unbounded.

A 64-byte hostname together with the maximum 252-byte dhcpclass=
identifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 available
bytes even before the terminating END marker, so the vendor-class memcpy
runs past the end of exten[].  With CONFIG_FORTIFY_SOURCE this is
reported as a field-spanning write and, when the kernel is booted with
panic_on_warn=1, aborts boot with a panic.

Route the optional options through a common helper that makes sure the
option, its 2-byte header and the END marker all fit and drops an option
that would not.  Configurations with short options keep sending exactly
the same bytes as before.

Fixes: 130c0f47fd ("ipconfig: send host-name in DHCP requests")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: LLM
Signed-off-by: Yuqi Xu <xuyuqiabc@gmail.com>
Reviewed-by: Ren Wei <weir@nebusec.ai>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/7808dfbfa2162dfd0b19f59aff5742d6e0db2abb.1789798023.git.xuyuqiabc@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-24 10:57:51 +02:00
..
netfilter netfilter: arp_tables: remove the 32bit compat interface 2026-09-07 18:48:52 +02:00
af_inet.c ipv4: remove obsolete EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL() 2026-06-05 17:47:07 -07:00
ah4.c xfrm: ah: use skb_to_full_sk in async output callbacks 2026-05-16 10:56:14 +02:00
arp.c net: arp: terminate device name before lookup 2026-09-23 19:00:15 -07:00
bpf_tcp_ca.c bpf: Reject TCP_NODELAY in bpf-tcp-cc 2026-04-22 12:58:57 -07:00
cipso_ipv4.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
datagram.c raw: annotate lockless match fields in raw_v4_match() 2026-07-23 07:46:12 -07:00
devinet.c net: allow IFLA_INET_CONF messages when NLA_F_NESTED unset 2026-09-18 18:22:59 -07:00
esp4_offload.c xfrm: Fix inner mode lookup in tunnel mode GSO segmentation 2025-12-04 09:54:53 +01:00
esp4.c ipsec-2026-09-16 2026-09-16 15:54:19 -07:00
fib_frontend.c ipv4: fib: Define fib_table_hash_lock under CONFIG_IP_MULTIPLE_TABLES. 2026-07-07 10:51:06 +02:00
fib_lookup.h ipv4: fib: Annotate access to struct fib_alias.fa_state. 2026-01-28 19:33:07 -08:00
fib_notifier.c net: do not acquire rtnl in fib_seq_sum() 2024-10-11 15:35:05 -07:00
fib_rules.c ipv4: fib: bound automatic table ID allocation 2026-09-03 16:58:32 -07:00
fib_semantics.c ipv4: fib: fix data-race and stale genid check around nh->nh_saddr 2026-09-17 19:19:04 -07:00
fib_trie.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-20 09:18:11 +02:00
fou_bpf.c ip_tunnel: convert __be16 tunnel flags to bitmaps 2024-04-01 10:49:28 +01:00
fou_core.c fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT 2026-09-23 18:43:08 -07:00
fou_nl.c fou: Don't allow 0 for FOU_ATTR_IPPROTO. 2026-01-17 16:00:24 -08:00
fou_nl.h tools: ynl-gen: add regeneration comment 2025-11-25 19:20:42 -08:00
gre_demux.c gre: Count GRE packet drops 2026-04-12 12:33:33 -07:00
gre_offload.c net: gro: rename skb_gro_header_hard() 2024-03-05 13:30:11 +01:00
icmp.c ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup 2026-09-15 10:20:38 +02:00
igmp_internal.h netlink: support dumping IPv4 multicast addresses 2025-02-11 11:26:53 +01:00
igmp.c igmp: convert struct ip_sf_list to RCU 2026-08-31 17:22:03 -07:00
inet_connection_sock.c tcp: fix TFO max_qlen accounting across reuseport migration 2026-08-05 17:10:28 -07:00
inet_diag.c inet_diag: report delayed ack timer information 2026-03-06 16:32:26 -08:00
inet_fragment.c inet: frags: invalidate queues before flushing them 2026-09-09 17:43:03 -07:00
inet_hashtables.c net: remove some unused EXPORT_SYMBOL()s 2026-06-12 16:43:11 -07:00
inet_timewait_sock.c inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() 2025-10-17 16:08:43 -07:00
inetpeer.c inetpeer: randomize RB-tree node comparison using SipHash 2026-08-20 12:55:31 -07:00
ip_forward.c net: fix IPSTATS_MIB_OUTFORWDATAGRAMS increment after fragment check 2023-10-13 09:58:45 -07:00
ip_fragment.c inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush 2026-06-04 18:05:23 -07:00
ip_gre.c ip_gre: Reject enabling collect metadata through changelink 2026-09-23 19:17:46 -07:00
ip_input.c tcp: move tcp_v4_early_demux() to net/ipv4/ip_input.c 2026-03-09 18:50:24 -07:00
ip_options.c ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options 2026-06-03 18:53:14 -07:00
ip_output.c net: ipv4: Fix UDP length overflow with PMTU discover and big MTU 2026-09-07 17:13:55 -07:00
ip_sockglue.c net: remove addr_len argument of recvmsg() handlers 2026-03-02 18:17:17 -08:00
ip_tunnel_core.c net: ip_tunnel: initialize options_len before referencing options 2026-09-15 17:34:31 -07:00
ip_tunnel.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-18 10:42:41 -07:00
ip_vti.c net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink 2026-06-17 16:01:52 -07:00
ipcomp.c xfrm: add extack to xfrm_init_state 2026-06-04 12:22:35 +02:00
ipconfig.c net: ipconfig: bound DHCP option construction 2026-09-24 10:57:51 +02:00
ipip.c ipip: fix skb leak in collect_md mode when metadata_dst allocation fails 2026-08-22 13:03:10 -07:00
ipmr_base.c ipmr: account multicast table and route memory 2026-09-10 08:48:44 -07:00
ipmr.c ipmr: account multicast table and route memory 2026-09-10 08:48:44 -07:00
Kconfig net/tcp: Remove tcp_sigpool 2026-04-30 09:38:56 +02:00
Makefile netfilter: add option for GCOV profiling 2026-05-24 22:55:47 +02:00
metrics.c net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros 2026-03-29 11:21:22 -07:00
netfilter.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
netlink.c
nexthop.c nexthop: Initialize extack in remove_nh_grp_entry() 2026-09-04 15:17:41 -07:00
ping.c Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
proc.c udp: Remove UDP-Lite SNMP stats. 2026-03-13 18:57:44 -07:00
protocol.c
raw_diag.c inet_diag: change inet_diag_bc_sk() first argument 2025-08-29 19:29:24 -07:00
raw.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-23 14:07:40 -07:00
route.c net: advertise TCP MSS from the configured MTU, not the learned PMTU 2026-08-20 12:14:23 -07:00
syncookies.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
sysctl_net_ipv4.c tcp: do not let tcp_rmem be set below 4096 2026-09-15 15:21:17 +02:00
tcp_ao.c tcp: fix AO info use-after-free in tcp_ao_connect_init() 2026-08-27 12:10:55 +02:00
tcp_bbr.c tcp_bbr: fix SPDX-License-Identifier to be GPL-2.0 OR BSD-3-Clause 2026-06-01 16:51:08 -07:00
tcp_bic.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_bpf.c bpf, sockmap: Fix sk_redir use-after-free in send verdict 2026-08-01 18:24:58 +02:00
tcp_cdg.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_cong.c tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) 2026-08-28 16:09:02 -07:00
tcp_cubic.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_dctcp.c tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) 2026-08-28 16:09:02 -07:00
tcp_dctcp.h net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
tcp_diag.c inet_diag: report delayed ack timer information 2026-03-06 16:32:26 -08:00
tcp_fastopen.c net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros 2026-03-29 11:21:22 -07:00
tcp_highspeed.c
tcp_htcp.c tcp: Use clamp() in htcp_alpha_update() 2024-08-06 12:16:25 -07:00
tcp_hybla.c
tcp_illinois.c
tcp_input.c tcp: exclude old ACKs from tcp fast path 2026-09-17 15:17:58 +02:00
tcp_ipv4.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
tcp_lp.c net: tcp_lp: fix kernel-doc warnings and update outdated reference links 2025-10-28 17:52:44 -07:00
tcp_metrics.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_minisocks.c tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) 2026-08-28 16:09:02 -07:00
tcp_nv.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_offload.c net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list() 2026-09-03 12:20:38 +02:00
tcp_output.c tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) 2026-08-28 16:09:02 -07:00
tcp_plb.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
tcp_recovery.c tcp: move tcp_rack_advance() to tcp_input.c 2026-01-28 19:31:51 -08:00
tcp_scalable.c
tcp_timer.c tcp: use GFP_ATOMIC in tcp_send_active_reset() 2026-08-28 15:35:38 -07:00
tcp_ulp.c net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() 2026-09-16 19:18:24 -07:00
tcp_vegas.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_vegas.h tcp: add cwnd_event_tx_start to tcp_congestion_ops 2026-03-24 21:00:38 -07:00
tcp_veno.c tcp: add cwnd_event_tx_start to tcp_congestion_ops 2026-03-24 21:00:38 -07:00
tcp_westwood.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_yeah.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp.c tcp: reject non zerocopy devmem tx 2026-09-10 14:45:57 +02:00
tunnel4.c net: fill in MODULE_DESCRIPTION()s for ipv4 modules 2024-02-09 14:12:02 -08:00
udp_bpf.c sockmap: Fix use-after-free in udp_bpf_recvmsg() 2026-06-14 21:30:20 -07:00
udp_diag.c udp: Don't pass udptable to IPv4 socket lookup functions. 2026-03-13 18:57:46 -07:00
udp_offload.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-06 11:53:47 -07:00
udp_tunnel_core.c udp: Set length in UDP header to 0 for big GSO packets 2026-07-22 13:47:02 +02:00
udp_tunnel_nic.c net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() 2026-07-28 13:32:34 +02:00
udp_tunnel_stub.c
udp.c udp: remove a disconnected socket from the 4-tuple hash table 2026-09-22 10:57:53 +02:00
xfrm4_input.c xfrm: Fix dev use-after-free in xfrm async resumption 2026-06-12 08:39:59 +02:00
xfrm4_output.c ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] 2025-07-02 14:32:30 -07:00
xfrm4_policy.c net: Const qualify network templated ctl_tables Arrays 2026-08-13 13:12:24 +02:00
xfrm4_protocol.c ipv4: Convert ip_route_input_noref() to dscp_t. 2024-10-03 16:21:21 -07:00
xfrm4_state.c
xfrm4_tunnel.c net: fill in MODULE_DESCRIPTION()s for ipv4 modules 2024-02-09 14:12:02 -08:00