Hannes Frederic Sowa 3a1cebe7e0 ipv6: fix calculation of option len in ip6_append_data ...

tot_len does specify the size of struct ipv6_txoptions. We need opt_flen +
opt_nflen to calculate the overall length of additional ipv6 extensions.

I found this while auditing the ipv6 output path for a memory corruption
reported by Alexey Preobrazhensky while he fuzzed an instrumented
AddressSanitizer kernel with trinity. This may or may not be the cause
of the original bug.

Fixes: 4df98e76cde7c6 ("ipv6: pmtudisc setting not respected with UFO/CORK")
Reported-by: Alexey Preobrazhensky <preobr@google.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

2014-05-14 00:40:27 -04:00

..

9p

A bunch of updates and cleanup within the transport layer,

2014-04-11 14:14:57 -07:00

802

neigh: use NEIGH_VAR_INIT in ndo_neigh_setup functions.

2014-01-16 11:31:58 -08:00

8021q

vlan: Fix lockdep warning when vlan dev handle notification

2014-04-18 17:48:30 -04:00

appletalk

appletalk: fix checkpatch error with indent

2014-02-14 16:18:32 -05:00

atm

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

ax25

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

batman-adv

batman-adv: fix removing neigh_ifinfo

2014-05-11 09:10:58 +02:00

bluetooth

Bluetooth: Fix redundant encryption request for reauthentication

2014-04-25 09:47:15 +03:00

bridge

bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit

2014-05-05 16:05:43 +02:00

caif

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

can

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

ceph

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client

2014-05-05 15:17:02 -07:00

core

net: avoid dependency of net_get_random_once on nop patching

2014-05-14 00:37:34 -04:00

dcb

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

dccp

ipv4: add a sock pointer to ip_queue_xmit()

2014-04-15 12:58:34 -04:00

decnet

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

dns_resolver

net/*: Fix FSF address in file headers

2013-12-06 12:37:57 -05:00

dsa

dsa: Use ether_addr_copy

2014-01-21 18:13:05 -08:00

ethernet

net: eth_type_trans() should use skb_header_pointer()

2014-01-16 15:30:31 -08:00

hsr

hsr: replace del_timer by del_timer_sync

2014-03-27 15:28:06 -04:00

ieee802154

mac802154: make csma/cca parameters per-wpan

2014-04-01 16:25:51 -04:00

ipv4

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

2014-05-09 13:17:30 -04:00

ipv6

ipv6: fix calculation of option len in ip6_append_data

2014-05-14 00:40:27 -04:00

ipx

ipx: implement shutdown()

2014-02-12 19:26:32 -05:00

irda

net: add build-time checks for msg->msg_name size

2014-01-18 23:04:16 -08:00

iucv

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

key

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

l2tp

ipv4: add a sock pointer to ip_queue_xmit()

2014-04-15 12:58:34 -04:00

lapb

…

llc

llc: remove noisy WARN from llc_mac_hdr_init

2014-01-28 18:01:32 -08:00

mac80211

mac80211: fix nested rtnl locking on ieee80211_reconfig

2014-05-05 15:14:58 +02:00

mac802154

mac802154: fix duplicate #include headers

2014-04-07 13:18:44 -04:00

mpls

…

netfilter

netfilter: nfnetlink: Fix use after free when it fails to process batch

2014-05-04 15:14:08 +02:00

netlabel

netlabel: Fix FSF address in file headers

2013-12-06 12:37:56 -05:00

netlink

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

netrom

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

nfc

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

openvswitch

ipv4: add a sock pointer to dst->output() path.

2014-04-15 13:47:15 -04:00

packet

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

phonet

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

rds

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

rfkill

net: rfkill: move poll work to power efficient workqueue

2014-02-04 21:58:16 +01:00

rose

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

rxrpc

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

sched

net: sched: lock imbalance in hhf qdisc

2014-05-04 19:41:45 -04:00

sctp

net: sctp: Don't transition to PF state when transport has exhausted 'Path.Max.Retrans'.

2014-04-27 23:41:14 -04:00

sunrpc

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2014-04-12 17:31:22 -07:00

tipc

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

unix

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

vmw_vsock

vsock: Make transport the proto owner

2014-05-05 13:13:50 -04:00

wimax

wimax: remove dead code

2013-11-21 13:09:42 -05:00

wireless

cfg80211: add cfg80211_sched_scan_stopped_rtnl

2014-05-05 15:14:57 +02:00

x25

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

xfrm

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

compat.c

net/compat: convert to COMPAT_SYSCALL_DEFINE with changing parameter types

2014-03-06 16:30:45 +01:00

Kconfig

Merge branch 'for-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

2014-04-03 13:05:42 -07:00

Makefile

net: move 6lowpan compression code to separate module

2014-01-15 15:36:38 -08:00

nonet.c

…

socket.c

net: use SYSCALL_DEFINEx for sys_recv

2014-04-16 15:15:05 -04:00

sysctl_net.c

…