Jon Maloy 9aa422ad32 tipc: improve size validations for received domain records ... The function tipc_mon_rcv() allows a node to receive and process domain_record structs from peer nodes to track their views of the network topology. This patch verifies that the number of members in a received domain record does not exceed the limit defined by MAX_MON_DOMAIN, something that may otherwise lead to a stack overflow. tipc_mon_rcv() is called from the function tipc_link_proto_rcv(), where we are reading a 32 bit message data length field into a uint16. To avert any risk of bit overflow, we add an extra sanity check for this in that function. We cannot see that happen with the current code, but future designers being unaware of this risk, may introduce it by allowing delivery of very large (> 64k) sk buffers from the bearer layer. This potential problem was identified by Eric Dumazet. This fixes CVE-2022-0435 Reported-by: Samuel Page <samuel.page@appgate.com> Reported-by: Eric Dumazet <edumazet@google.com> Fixes: 35c55c9877 ("tipc: add neighbor monitoring framework") Signed-off-by: Jon Maloy <jmaloy@redhat.com> Reviewed-by: Xin Long <lucien.xin@gmail.com> Reviewed-by: Samuel Page <samuel.page@appgate.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2022-02-10 05:37:44 -08:00
..
6lowpan	6lowpan: iphc: Fix an off-by-one check of array index	2021-07-22 16:19:03 +02:00
9p	virtio,vdpa,qemu_fw_cfg: features, cleanups, fixes	2022-01-18 10:05:48 +02:00
802	net: 802: Use memset_startat() to clear struct fields	2021-11-19 11:23:23 +00:00
8021q	vlan: add net device refcount tracker	2021-12-07 20:44:58 -08:00
appletalk	net: socket: rework compat_ifreq_ioctl()	2021-07-23 14:20:25 +01:00
atm	proc: remove PDE_DATA() completely	2022-01-22 08:33:37 +02:00
ax25	ax25: fix reference count leaks of ax25_dev	2022-02-03 14:20:36 -08:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-01-05 14:36:10 -08:00
bluetooth	proc: remove PDE_DATA() completely	2022-01-22 08:33:37 +02:00
bpf	bpf: Add dummy BPF STRUCT_OPS for test purpose	2021-11-01 14:10:00 -07:00
bpfilter	bpfilter: Specify the log level for the kmsg message	2021-06-25 13:13:50 +02:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2022-01-27 18:53:02 -08:00
caif	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2021-12-31 14:35:40 +00:00
can	proc: remove PDE_DATA() completely	2022-01-22 08:33:37 +02:00
ceph	libceph: optionally use bounce buffer on recv path in crc mode	2022-02-02 18:50:36 +01:00
core	net, neigh: Do not trigger immediate probes on NUD_FAILED from neigh_managed_work	2022-02-02 20:30:18 -08:00
dcb	…
dccp	dccp: Inline dccp_listen_start().	2021-11-23 20:16:22 -08:00
decnet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2021-12-31 14:35:40 +00:00
dns_resolver	…
dsa	net: dsa: setup master before ports	2022-01-06 11:59:10 +00:00
ethernet	gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers	2021-11-24 17:21:42 -08:00
ethtool	ethtool: use phydev variable	2022-01-06 12:33:35 +00:00
hsr	net: Write lock dev_base_lock without disabling bottom halves.	2021-11-29 12:12:36 +00:00
ieee802154	net: ieee802154: Return meaningful error codes from the netlink helpers	2022-01-27 08:20:47 +01:00
ife	…
ipv4	tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data()	2022-02-02 16:22:37 -08:00
ipv6	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2022-01-27 18:53:02 -08:00
iucv	net: Don't include filter.h from net/sock.h	2021-12-29 08:48:14 -08:00
kcm	net: Don't include filter.h from net/sock.h	2021-12-29 08:48:14 -08:00
key	…
l2tp	l2tp: add netns refcount tracker to l2tp_dfs_seq_data	2021-12-10 06:38:27 -08:00
l3mdev	…
lapb	…
llc	sock: Use sock_owned_by_user_nocheck() instead of sk_lock.owned.	2021-12-10 19:43:00 -08:00
mac80211	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-01-05 14:36:10 -08:00
mac802154	mac802154: use dev_addr_set() - manual	2021-10-20 14:27:40 +01:00
mctp	mctp: test: zero out sockaddr	2022-01-11 20:26:36 -08:00
mpls	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-12-02 11:44:56 -08:00
mptcp	mptcp: Use struct_group() to avoid cross-field memset()	2022-01-21 19:26:03 -08:00
ncsi	all: replace find_next{,_zero}_bit with find_first{,_zero}_bit where appropriate	2022-01-15 08:47:31 -08:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2022-01-27 18:53:02 -08:00
netlabel	lsm: security_task_getsecid_subj() -> security_current_getsecid_subj()	2021-11-22 17:52:47 -05:00
netlink	net: Don't include filter.h from net/sock.h	2021-12-29 08:48:14 -08:00
netrom	netrom: fix api breakage in nr_setsockopt()	2022-01-07 14:11:05 +00:00
nfc	Networking fixes for 5.17-rc1, including fixes from netfilter, bpf.	2022-01-20 10:57:05 +02:00
nsh	…
openvswitch	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-01-09 17:00:17 -08:00
packet	af_packet: fix data-race in packet_setsockopt / packet_setsockopt	2022-02-01 20:21:10 -08:00
phonet	phonet/pep: refuse to enable an unbound pipe	2021-12-20 11:49:51 +00:00
psample	…
qrtr	bus: mhi: core: Add an API for auto queueing buffers for DL channel	2021-12-17 17:17:14 +01:00
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-12-16 16:13:19 -08:00
rfkill	rfkill: allow to get the software rfkill state	2021-12-20 11:02:38 +01:00
rose	net: Don't include filter.h from net/sock.h	2021-12-29 08:48:14 -08:00
rxrpc	rxrpc: Adjust retransmission backoff	2022-01-22 02:03:24 +00:00
sched	net: sched: fix use-after-free in tc_new_tfilter()	2022-02-01 20:15:58 -08:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-01-05 14:36:10 -08:00
smc	Partially revert "net/smc: Add netlink net namespace support"	2022-02-02 07:42:41 -08:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-09 01:05:28 +01:00
sunrpc	SUNRPC: lock against ->sock changing during sysfs read	2022-02-08 09:14:26 -05:00
switchdev	net: switchdev: add net device refcount tracker	2021-12-07 20:44:58 -08:00
tipc	tipc: improve size validations for received domain records	2022-02-10 05:37:44 -08:00
tls	net/tls: Fix another skb memory leak when running kTLS traffic	2022-01-17 13:07:47 +00:00
unix	af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress	2022-01-14 18:31:37 -08:00
vmw_vsock	virtio,vdpa,qemu_fw_cfg: features, cleanups, fixes	2022-01-18 10:05:48 +02:00
wireless	Kbuild updates for v5.17	2022-01-19 11:15:19 +02:00
x25	net: x25: drop harmless check of !more	2021-12-09 18:35:11 -08:00
xdp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-01-05 14:36:10 -08:00
xfrm	xfrm: Don't accidentally set RTO_ONLINK in decode_session4()	2022-01-11 20:36:08 -08:00
Kconfig	net: kunit: add a test for dev_addr_lists	2021-11-20 12:25:57 +00:00
Kconfig.debug	net: add networking namespace refcount tracker	2021-12-10 06:38:26 -08:00
Makefile	mctp: Add MCTP base	2021-07-29 15:06:49 +01:00
compat.c	…
devres.c	…
socket.c	net: fix SOF_TIMESTAMPING_BIND_PHC to work with multiple sockets	2022-01-06 12:18:08 +00:00
sysctl_net.c	sections: move and rename core_kernel_data() to is_kernel_core_data()	2021-11-09 10:02:50 -08:00