Cong Wang 227f0246c7 bonding: validate ip header before check IPPROTO_IGMP ...

[ Upstream commit 9d1bc24b52 ]

bond_xmit_roundrobin() checks for IGMP packets but it parses
the IP header even before checking skb->protocol.

We should validate the IP header with pskb_may_pull() before
using iph->protocol.

Reported-and-tested-by: syzbot+e5be16aa39ad6e755391@syzkaller.appspotmail.com
Fixes: a2fd940f4c ("bonding: fix broken multicast with round-robin mode")
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Cc: Veaceslav Falico <vfalico@gmail.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-08-04 09:33:35 +02:00

..

appletalk

net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT

2018-09-29 03:07:32 -07:00

arcnet

arcnet: com90xx: add __init attribute

2016-04-19 20:17:45 -04:00

bonding

bonding: validate ip header before check IPPROTO_IGMP

2019-08-04 09:33:35 +02:00

caif

caif-hsi: fix possible deadlock in cfhsi_exit_module()

2019-08-04 09:33:33 +02:00

can

can: mcp251x: add support for mcp25625

2019-07-21 09:05:54 +02:00

cris

treewide: replace dev->trans_start update with helper

2016-05-04 14:16:49 -04:00

dsa

net: dsa: mv88e6xxx: wait after reset deactivation

2019-08-04 09:33:33 +02:00

ethernet

sky2: Disable MSI on ASUS P6T

2019-08-04 09:33:34 +02:00

fddi

net: skfb: remove obsolete -I cflag

2016-06-15 22:06:06 -07:00

fjes

fjes: Fix wrong netdevice feature flags

2017-12-20 10:07:22 +01:00

hamradio

net: hamradio: use eth_broadcast_addr

2018-08-24 13:12:30 +02:00

hippi

hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close

2018-02-25 11:05:50 +01:00

hyperv

hv_netvsc: Fix IP header checksum for coalesced packets

2019-03-13 14:04:53 -07:00

ieee802154

ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem

2018-08-24 13:12:37 +02:00

ipvlan

ipvlan: disallow userns cap_net_admin to change global mode/flags

2019-03-19 13:14:10 +01:00

irda

irda: vlsi_ir: fix check for DMA mapping errors

2017-12-25 14:23:41 +01:00

phy

net: phy: Check against net_device being NULL

2019-08-04 09:33:17 +02:00

plip

net: plip: use new parport device model

2016-01-09 21:02:05 -05:00

ppp

ppp: mppe: Add softdep to arc4

2019-07-21 09:06:06 +02:00

slip

slip: make slhc_free() silently accept an error pointer

2019-05-02 09:32:03 +02:00

team

team: Always enable vlan tx offload

2019-07-10 09:55:41 +02:00

usb

net: usb: asix: init MAC address buffers

2019-08-04 09:33:24 +02:00

vmxnet3

vmxnet3: use DMA memory barriers where required

2018-05-25 16:12:56 +02:00

wan

net/wan: fix a double free in x25_asy_open_tty()

2019-01-09 16:16:40 +01:00

wimax

net: wimax/i2400m: fix NULL-deref at probe

2017-12-20 10:07:20 +01:00

wireless

iwlwifi: pcie: don't service an interrupt that was masked

2019-08-04 09:33:26 +02:00

xen-netback

xen-netback: fix occasional leak of grant ref mappings under memory pressure

2019-03-13 14:04:53 -07:00

dummy.c

…

eql.c

…

geneve.c

geneve: add missing rx stats accounting

2018-04-13 19:48:26 +02:00

gtp.c

gtp: fix use-after-free in gtp_newlink()

2019-08-04 09:33:25 +02:00

ifb.c

ifb: support more features

2016-05-09 00:00:28 -04:00

Kconfig

vmxnet3: prevent building with 64K pages

2018-02-25 11:05:51 +01:00

LICENSE.SRC

…

loopback.c

net: introduce device min_header_len

2017-02-18 15:11:43 +01:00

macsec.c

macsec: fix checksumming after decryption

2019-08-04 09:33:34 +02:00

macvlan.c

macvlan: fix use-after-free in macvlan_common_newlink()

2018-05-30 07:50:30 +02:00

macvtap.c

tap: double-free in error path in tap_open()

2017-11-18 11:22:22 +01:00

Makefile

gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)

2016-05-10 12:25:04 -04:00

mdio.c

…

mii.c

…

netconsole.c

…

nlmon.c

…

ntb_netdev.c

…

rionet.c

rapidio/rionet: do not free skb before reading its length

2018-12-05 19:42:38 +01:00

sb1000.c

…

Space.c

net: Fix coding style warnings and errors.

2016-05-19 11:48:27 -07:00

sungem_phy.c

…

tun.c

tun: wake up waitqueues after IFF_UP is set

2019-07-10 09:55:41 +02:00

veth.c

veth: set peer GSO values

2018-03-22 09:17:57 +01:00

virtio_net.c

virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS

2018-05-30 07:50:44 +02:00

vrf.c

vrf: make sure skb->data contains ip header to make routing

2019-08-04 09:33:34 +02:00

vxlan.c

vxlan: Don't call gro_cells_destroy() before device is unregistered

2019-04-03 06:24:15 +02:00

xen-netfront.c

xen/netfront: tolerate frags with no data

2019-01-09 16:16:41 +01:00