github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-23 23:51:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
4bcfe29021
linux/net/core
History
Josef Bacik ab9414ed70 net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() 
When skb_copy_and_csum_bits() reaches unreadable frags it returns 0
after copying only the linear part, and the rest of the caller's buffer
is left as it was.  The callers copy into a buffer that is about to go
out on the wire: an ICMP error quoting the offending packet, or a
driver's TX bounce buffer in skb_copy_and_csum_dev().  Neither buffer
is zeroed beforehand, so whatever was in memory there gets sent.

Zero the part of the buffer we didn't fill.  The checksum usually
won't match the data any more, so the receiver will usually drop the
packet, but either way it no longer carries anything it shouldn't.
Only zero for a positive @len, a negative one from a broken caller must
not turn into a huge memset().

Fixes: 65249feb6b ("net: add support for skbs with unreadable frags")
Cc: stable@vger.kernel.org
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: Mina Almasry <almasrymina@google.com>
Link: https://patch.msgid.link/20261007-b4-skb-copy-csum-stale-bytes-v1-1-adbbde033fb3@toxicpanda.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-08 10:57:41 -07:00
..
bpf_ksock.c bpf: Add ksock kfuncs 2026-08-15 23:36:18 +02:00
bpf_sk_storage.c bpf: Fix UAF in sock clone early bailouts 2026-07-09 18:44:16 +02:00
datagram.c net: devmem: prevent net-iov / page mixing 2026-07-30 16:27:03 -07:00
dev_addr_lists_test.c net: cache snapshot entries for ndo_set_rx_mode_async 2026-04-21 12:50:13 +02:00
dev_addr_lists.c net: turn the rx_mode work into a generic netdev_work facility 2026-06-25 10:18:40 -07:00
dev_api.c net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work 2026-04-21 12:50:03 +02:00
dev_ioctl.c net: ethtool: let tsconfig reach a PHY-only timestamp provider 2026-09-28 19:26:41 -07:00
dev.c net: make dev_xdp_sb_prog_count() see programs attached through a link 2026-10-05 15:01:19 -07:00
dev.h net: flush skb_defer_nodes in dev_cpu_dead() 2026-09-24 10:48:10 -07:00
devmem.c net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding 2026-08-07 18:32:39 -07:00
devmem.h net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding 2026-08-07 18:32:39 -07:00
drop_monitor.c drop_monitor: fix out-of-bounds write in reset_per_cpu_data() 2026-09-15 17:58:35 -07:00
dst_cache.c
dst.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
failover.c net: failover: check register_netdevice_notifier() error in failover_init() 2026-08-04 18:46:34 -07:00
fib_notifier.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
fib_rules.c net: fib_rules: Destroy ops->lock in fib_rules_unregister(). 2026-07-07 10:51:06 +02:00
filter.c bpf: Fix bpf_sock context code generation 2026-09-22 19:34:04 +00:00
flow_dissector.c flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() 2026-10-07 17:57:04 -07:00
flow_offload.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
gen_estimator.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
gen_stats.c net/sched: add const qualifiers to gnet_stats helpers 2026-05-11 18:28:08 -07:00
gro_cells.c net: iptunnel: fix stale transport header during tunnel decapsulation 2026-08-28 15:53:46 -07:00
gro.c net: gro: fix double aggregation of flush-marked skbs 2026-07-21 08:30:54 -07:00
gso.c net: gso: limit recursive IP-in-IP segmentation 2026-09-29 12:02:37 +02:00
hotdata.c net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros 2026-03-29 11:21:22 -07:00
hwbm.c
ieee8021q_helpers.c
link_watch.c net: rename netdev_ops_assert_locked() 2026-06-04 14:04:55 -07:00
lock_debug.c net: require instance lock for NETDEV_DOWN/GOING_DOWN notifiers 2026-07-07 15:31:37 +02:00
lwt_bpf.c lwt_bpf: Restore reserved headroom after xmit program 2026-08-17 10:59:03 +02:00
lwtunnel.c net: lwtunnel: Drop skb metadata before LWT encapsulation 2026-06-23 19:07:23 -07:00
Makefile bpf: Add ksock kfuncs 2026-08-15 23:36:18 +02:00
mp_dmabuf_devmem.h
neighbour.c neighbour: Skip default parms when resumed in neightbl_dump_info(). 2026-09-11 17:25:14 -07:00
net_namespace.c net: fix a resource leak in copy_net_ns() error handling path 2026-08-25 12:30:55 +02:00
net_test.c
net-procfs.c net: add proper RCU protection to /proc/net/ptype 2026-02-03 19:20:30 -08:00
net-sysfs.c net: add READ_ONCE()/WRITE_ONCE() annotations for dev->num_tc 2026-08-17 10:27:48 -07:00
net-sysfs.h net: Defer netdev KOBJ_ADD uevent until the device is published 2026-08-06 09:36:18 -07:00
net-traces.c
netclassid_cgroup.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
netdev_config.c net: add queue config validation callback 2026-01-23 11:49:02 -08:00
netdev_queues.c net: expect instance lock in netdev_queue_get_dma_dev() 2026-08-10 15:54:42 -07:00
netdev_rx_queue.c net: Stop leased rxq before uninstalling its memory provider 2026-06-11 15:57:39 -07:00
netdev_work.c net: avoid theoretical races with ref drain 2026-08-06 09:37:03 -07:00
netdev-genl-gen.c net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding 2026-08-07 18:32:39 -07:00
netdev-genl-gen.h net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding 2026-08-07 18:32:39 -07:00
netdev-genl.c net: devmem: document that bind-tx is unprivileged by design 2026-09-22 18:40:15 -07:00
netevent.c
netmem_priv.h Revert "mm: introduce a new page type for page pool in page type" 2026-05-21 19:06:13 -07:00
netpoll.c netconsole: move netpoll_wait_carrier() as netcons_wait_carrier() 2026-07-30 12:14:39 +02:00
netprio_cgroup.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
of_net.c
page_pool_priv.h
page_pool_user.c net: make page_pool_get_stats() void 2026-05-28 18:10:03 -07:00
page_pool.c net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() 2026-09-28 18:24:05 -07:00
pktgen.c net: pktgen: use a consistent flow count 2026-08-17 12:50:51 -07:00
ptp_classifier.c
rtnetlink.c net: reject oversized tx_queue_len at netlink parse time 2026-09-04 16:30:49 -07:00
scm.c net: af_unix: useful handling of LSM denials on SCM_RIGHTS 2026-08-17 18:14:52 -07:00
secure_seq.c tcp: secure_seq: add back ports to TS offset 2026-03-04 17:44:35 -08:00
selftests.c net: Use helpers to get/set UDP len tree-wide 2026-07-22 13:47:02 +02:00
skb_fault_injection.c
skbuff.c net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() 2026-10-08 10:57:41 -07:00
skmsg.c bpf, sockmap: Fix self-redirect copied_seq double-counting 2026-09-13 21:50:26 -07:00
sock_diag.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
sock_map.c bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc 2026-09-22 23:52:20 +00:00
sock_reuseport.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
sock.c net: restrict SO_RESERVE_MEM to TCP sockets and cap max value 2026-09-28 19:31:54 -07:00
stream.c net: remove some unused EXPORT_SYMBOL()s 2026-06-12 16:43:11 -07:00
sysctl_net_core.c net: Const qualify network templated ctl_tables Arrays 2026-08-13 13:12:24 +02:00
timestamping.c
tso.c net: Use helpers to get/set UDP len tree-wide 2026-07-22 13:47:02 +02:00
utils.c kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
xdp.c xdp: fix zero-copy frame layout 2026-08-22 13:10:48 -07:00