Cong Wang 1b7446e4b3 bonding: validate ip header before check IPPROTO_IGMP ...

[ Upstream commit 9d1bc24b52 ]

bond_xmit_roundrobin() checks for IGMP packets but it parses
the IP header even before checking skb->protocol.

We should validate the IP header with pskb_may_pull() before
using iph->protocol.

Reported-and-tested-by: syzbot+e5be16aa39ad6e755391@syzkaller.appspotmail.com
Fixes: a2fd940f4c ("bonding: fix broken multicast with round-robin mode")
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Cc: Veaceslav Falico <vfalico@gmail.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-05-15 14:05:31 +09:00

..

appletalk

net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT

2023-05-15 08:25:07 +09:00

arcnet

…

bonding

bonding: validate ip header before check IPPROTO_IGMP

2023-05-15 14:05:31 +09:00

caif

caif-hsi: fix possible deadlock in cfhsi_exit_module()

2023-05-15 14:03:16 +09:00

can

can: mcp251x: add support for mcp25625

2023-05-15 13:58:06 +09:00

cris

…

dsa

net: dsa: mv88e6xxx: wait after reset deactivation

2023-05-15 14:03:38 +09:00

ethernet

sky2: Disable MSI on ASUS P6T

2023-05-15 14:04:21 +09:00

fddi

…

fjes

fjes: Fix wrong netdevice feature flags

2017-12-20 10:07:22 +01:00

hamradio

net: hamradio: use eth_broadcast_addr

2023-05-12 17:04:19 +09:00

hippi

hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close

2018-02-25 11:05:50 +01:00

hyperv

hv_netvsc: Fix IP header checksum for coalesced packets

2023-05-15 11:49:53 +09:00

ieee802154

ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem

2023-05-12 17:06:40 +09:00

ipvlan

ipvlan: disallow userns cap_net_admin to change global mode/flags

2023-05-15 11:55:28 +09:00

irda

irda: vlsi_ir: fix check for DMA mapping errors

2017-12-25 14:23:41 +01:00

phy

net: phy: Check against net_device being NULL

2023-05-15 13:59:55 +09:00

plip

…

ppp

ppp: mppe: Add softdep to arc4

2023-05-15 13:59:01 +09:00

slip

slip: make slhc_free() silently accept an error pointer

2023-05-15 12:35:39 +09:00

team

team: Always enable vlan tx offload

2023-05-15 13:56:22 +09:00

usb

net: usb: asix: init MAC address buffers

2023-05-15 14:01:30 +09:00

vmxnet3

vmxnet3: use DMA memory barriers where required

2018-05-25 16:12:56 +02:00

wan

net/wan: fix a double free in x25_asy_open_tty()

2023-05-15 10:49:02 +09:00

wimax

net: wimax/i2400m: fix NULL-deref at probe

2017-12-20 10:07:20 +01:00

wireless

iwlwifi: pcie: don't service an interrupt that was masked

2023-05-15 14:02:00 +09:00

xen-netback

xen-netback: fix occasional leak of grant ref mappings under memory pressure

2023-05-15 11:50:00 +09:00

dummy.c

…

eql.c

…

geneve.c

geneve: add missing rx stats accounting

2018-04-13 19:48:26 +02:00

gtp.c

gtp: fix use-after-free in gtp_newlink()

2023-05-15 14:01:41 +09:00

ifb.c

…

Kconfig

vmxnet3: prevent building with 64K pages

2018-02-25 11:05:51 +01:00

LICENSE.SRC

…

loopback.c

net: introduce device min_header_len

2017-02-18 15:11:43 +01:00

macsec.c

macsec: fix checksumming after decryption

2023-05-15 14:05:26 +09:00

macvlan.c

macvlan: fix use-after-free in macvlan_common_newlink()

2018-05-30 07:50:30 +02:00

macvtap.c

tap: double-free in error path in tap_open()

2017-11-18 11:22:22 +01:00

Makefile

…

mdio.c

…

mii.c

…

netconsole.c

…

nlmon.c

…

ntb_netdev.c

…

rionet.c

rapidio/rionet: do not free skb before reading its length

2023-05-15 10:05:03 +09:00

sb1000.c

…

Space.c

…

sungem_phy.c

…

tun.c

tun: wake up waitqueues after IFF_UP is set

2023-05-15 13:56:20 +09:00

veth.c

veth: set peer GSO values

2018-03-22 09:17:57 +01:00

virtio_net.c

virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS

2018-05-30 07:50:44 +02:00

vrf.c

vrf: make sure skb->data contains ip header to make routing

2023-05-15 14:04:23 +09:00

vxlan.c

vxlan: Don't call gro_cells_destroy() before device is unregistered

2023-05-15 12:12:11 +09:00

xen-netfront.c

xen/netfront: tolerate frags with no data

2023-05-15 10:49:09 +09:00