Alexey Kodanev 93040aa178 vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit ... [ Upstream commit 36f6ee22d2 ] When running LTP IPsec tests, KASan might report: BUG: KASAN: use-after-free in vti_tunnel_xmit+0xeee/0xff0 [ip_vti] Read of size 4 at addr ffff880dc6ad1980 by task swapper/0/0 ... Call Trace: <IRQ> dump_stack+0x63/0x89 print_address_description+0x7c/0x290 kasan_report+0x28d/0x370 ? vti_tunnel_xmit+0xeee/0xff0 [ip_vti] __asan_report_load4_noabort+0x19/0x20 vti_tunnel_xmit+0xeee/0xff0 [ip_vti] ? vti_init_net+0x190/0x190 [ip_vti] ? save_stack_trace+0x1b/0x20 ? save_stack+0x46/0xd0 dev_hard_start_xmit+0x147/0x510 ? icmp_echo.part.24+0x1f0/0x210 __dev_queue_xmit+0x1394/0x1c60 ... Freed by task 0: save_stack_trace+0x1b/0x20 save_stack+0x46/0xd0 kasan_slab_free+0x70/0xc0 kmem_cache_free+0x81/0x1e0 kfree_skbmem+0xb1/0xe0 kfree_skb+0x75/0x170 kfree_skb_list+0x3e/0x60 __dev_queue_xmit+0x1298/0x1c60 dev_queue_xmit+0x10/0x20 neigh_resolve_output+0x3a8/0x740 ip_finish_output2+0x5c0/0xe70 ip_finish_output+0x4ba/0x680 ip_output+0x1c1/0x3a0 xfrm_output_resume+0xc65/0x13d0 xfrm_output+0x1e4/0x380 xfrm4_output_finish+0x5c/0x70 Can be fixed if we get skb->len before dst_output(). Fixes: b9959fd3b0 ("vti: switch to new ip tunnel code") Fixes: 22e1b23daf ("vti6: Support inter address family tunneling.") Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-10-21 17:09:02 +02:00
..
netfilter	netfilter: invoke synchronize_rcu after set the _hook_ to NULL	2017-10-08 10:14:19 +02:00
af_inet.c	net: ping: do not abuse udp_poll()	2017-06-14 13:16:19 +02:00
ah4.c
arp.c	NET: Fix /proc/net/arp for AX.25	2017-06-17 06:39:35 +02:00
cipso_ipv4.c	netlabel: out of bound access in cipso_v4_validate()	2017-02-18 16:39:26 +01:00
datagram.c
devinet.c	ipv4: Don't do expensive useless work during inetdev destroy.	2016-04-20 15:42:03 +09:00
esp4.c	esp4: Fix integrity verification when ESN are used	2016-12-10 19:07:26 +01:00
fib_frontend.c	ipv4: initialize fib_trie prior to register_netdev_notifier call.	2017-08-11 09:08:52 -07:00
fib_lookup.h
fib_rules.c
fib_semantics.c	ipv4: fix NULL dereference in free_fib_info_rcu()	2017-08-30 10:19:18 +02:00
fib_trie.c	net: Improve handling of failures on link and route dumps	2017-06-07 12:05:58 +02:00
fou.c	net: add recursion limit to GRO	2016-11-15 07:46:38 +01:00
gre_demux.c
gre_offload.c	net: add recursion limit to GRO	2016-11-15 07:46:38 +01:00
icmp.c
igmp.c	igmp: add a missing spin_lock_init()	2017-07-05 14:37:14 +02:00
inet_connection_sock.c	dccp/tcp: do not inherit mc_list from parent	2017-06-07 12:05:56 +02:00
inet_diag.c
inet_fragment.c	Revert "net: use lib/percpu_counter API for fragmentation mem accounting"	2017-09-27 11:00:11 +02:00
inet_hashtables.c
inet_lro.c
inet_timewait_sock.c
inetpeer.c
ip_forward.c
ip_fragment.c	Revert "net: fix percpu memory leaks"	2017-09-27 11:00:11 +02:00
ip_gre.c	vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices	2016-06-24 10:18:18 -07:00
ip_input.c
ip_options.c
ip_output.c	net: account for current skb length when deciding about UFO	2017-08-12 19:29:09 -07:00
ip_sockglue.c	ip: fix IP_CHECKSUM handling	2017-02-26 11:07:50 +01:00
ip_tunnel_core.c	tunnels: Remove encapsulation offloads on decap.	2016-10-31 04:13:59 -06:00
ip_tunnel.c	vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices	2016-06-24 10:18:18 -07:00
ip_vti.c	vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit	2017-10-21 17:09:02 +02:00
ipcomp.c
ipconfig.c
ipip.c	ipip: ioctl: Remove superfluous IP-TTL handling.	2015-12-18 16:07:59 -05:00
ipmr.c	ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route	2016-11-15 07:46:37 +01:00
Kconfig
Makefile
netfilter.c
ping.c	ping: implement proper locking	2017-04-30 05:49:29 +02:00
proc.c
protocol.c
raw.c	ipv4, ipv6: ensure raw socket message is big enough to hold an IP header	2017-05-14 13:32:58 +02:00
route.c	ipv4: better IP_MAX_MTU enforcement	2017-08-30 10:19:19 +02:00
syncookies.c	ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()	2017-08-11 09:08:51 -07:00
sysctl_net_ipv4.c	ipv4: use the right lock for ping_group_range	2016-11-15 07:46:38 +01:00
tcp_bic.c
tcp_cdg.c
tcp_cong.c	tcp: disallow cwnd undo when switching congestion control	2017-06-14 13:16:19 +02:00
tcp_cubic.c
tcp_dctcp.c	dctcp: avoid bogus doubling of cwnd after loss	2016-11-21 10:06:39 +01:00
tcp_diag.c
tcp_fastopen.c	tcp: initialize max window for a new fastopen socket	2017-02-04 09:45:09 +01:00
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c
tcp_input.c	tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP	2017-08-30 10:19:21 +02:00
tcp_ipv4.c	dccp/tcp: fix routing redirect race	2017-03-22 12:04:17 +01:00
tcp_lp.c	tcp: fix wraparound issue in tcp_lp	2017-05-14 13:32:58 +02:00
tcp_memcontrol.c
tcp_metrics.c	tcp: convert cached rtt from usec to jiffies when feeding initial rto	2016-04-20 15:41:56 +09:00
tcp_minisocks.c	tcp: do not inherit fastopen_req from parent	2017-05-14 13:32:58 +02:00
tcp_offload.c
tcp_output.c	tcp: fastopen: tcp_connect() must refresh the route	2017-08-12 19:29:08 -07:00
tcp_probe.c
tcp_recovery.c
tcp_scalable.c
tcp_timer.c	net: fix keepalive code vs TCP_FASTOPEN_CONNECT	2017-08-12 19:29:08 -07:00
tcp_vegas.c
tcp_vegas.h
tcp_veno.c
tcp_westwood.c
tcp_yeah.c	tcp: cwnd does not increase in TCP YeAH	2016-09-30 10:18:34 +02:00
tcp.c	tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0	2017-09-27 11:00:11 +02:00
tunnel4.c
udp_diag.c
udp_impl.h
udp_offload.c	net: avoid skb_warn_bad_offload false positives on UFO	2017-08-12 19:29:08 -07:00
udp_tunnel.c	tunnel: Clear IPCB(skb)->opt before dst_link_failure called	2016-04-20 15:41:56 +09:00
udp.c	udp: consistently apply ufo or fragmentation	2017-08-12 19:29:09 -07:00
udplite.c
xfrm4_input.c
xfrm4_mode_beet.c
xfrm4_mode_transport.c
xfrm4_mode_tunnel.c
xfrm4_output.c
xfrm4_policy.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2015-12-22 16:26:31 -05:00
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c