Files
android_kernel_fxtec_sm6115/include/linux
Willem de Bruijn f12aa513fe net: stricter validation of untrusted gso packets
[ Upstream commit 9274124f023b5c56dc4326637d4f787968b03607 ]

Syzkaller again found a path to a kernel crash through bad gso input:
a packet with transport header extending beyond skb_headlen(skb).

Tighten validation at kernel entry:

- Verify that the transport header lies within the linear section.

    To avoid pulling linux/tcp.h, verify just sizeof tcphdr.
    tcp_gso_segment will call pskb_may_pull (th->doff * 4) before use.

- Match the gso_type against the ip_proto found by the flow dissector.

Fixes: bfd5f4a3d6 ("packet: Add GSO/csum offload support.")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-14 07:57:19 +02:00
..
2019-12-13 08:51:18 +01:00
2019-12-17 20:35:45 +01:00
2019-10-05 13:10:03 +02:00
2019-07-03 13:14:48 +02:00
2019-11-24 08:19:14 +01:00
2020-03-25 08:06:14 +01:00
2020-03-25 08:06:14 +01:00
2019-05-31 06:46:18 -07:00
2019-10-17 13:45:42 -07:00
2019-12-13 08:52:43 +01:00
2019-12-31 16:35:38 +01:00
2020-03-18 07:14:17 +01:00
2019-06-11 12:20:52 +02:00
2020-04-17 10:48:47 +02:00
2020-04-02 15:28:22 +02:00
2019-06-17 19:51:56 +02:00
2020-04-02 15:28:23 +02:00