Jann Horn f8a7f10a1d dccp: Fix out of bounds access in DCCP error handler ...

commit 977ad86c2a upstream.

There was a previous attempt to fix an out-of-bounds access in the DCCP
error handlers, but that fix assumed that the error handlers only want
to access the first 8 bytes of the DCCP header. Actually, they also look
at the DCCP sequence number, which is stored beyond 8 bytes, so an
explicit pskb_may_pull() is required.

Fixes: 6706a97fec ("dccp: fix out of bound access in dccp_v4_err()")
Fixes: 1aa9d1a0e7 ("ipv6: dccp: fix out of bound access in dccp_v6_err()")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-09-13 09:43:02 +02:00

..

ccids

dccp: tfrc: fix doc warnings in tfrc_equation.c

2021-06-10 14:08:49 -07:00

ackvec.c

net: dccp: Fix most of the kerneldoc warnings

2020-10-30 12:08:54 -07:00

ackvec.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

ccid.c

net: dccp: Add __printf() markup to fix -Wsuggest-attribute=format

2020-10-30 11:31:46 -07:00

ccid.h

net: dccp: Replace zero-length array with flexible-array member

2020-02-28 12:08:37 -08:00

dccp.h

dccp: Call inet6_destroy_sock() via sk->sk_destruct().

2023-04-26 14:28:43 +02:00

diag.c

inet_diag: Move the INET_DIAG_REQ_BYTECODE nlattr to cb->data

2020-02-27 18:50:19 -08:00

feat.c

dccp: Return the correct errno code

2021-02-06 11:15:28 -08:00

feat.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

input.c

net: dccp: Convert to use the preferred fallthrough macro

2020-08-22 12:38:34 -07:00

ipv4.c

dccp: Fix out of bounds access in DCCP error handler

2023-09-13 09:43:02 +02:00

ipv6.c

dccp: Fix out of bounds access in DCCP error handler

2023-09-13 09:43:02 +02:00

ipv6.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

Kconfig

dccp: Replace HTTP links with HTTPS ones

2020-07-13 11:54:07 -07:00

Makefile

net: dccp: Remove dccpprobe module

2018-01-02 14:27:30 -05:00

minisocks.c

tcp: allocate tcp_death_row outside of struct netns_ipv4

2022-01-26 19:00:31 -08:00

options.c

net: dccp: Convert to use the preferred fallthrough macro

2020-08-22 12:38:34 -07:00

output.c

dccp: fix data-race around dp->dccps_mss_cache

2023-08-16 18:27:27 +02:00

proto.c

dccp: annotate data-races in dccp_poll()

2023-08-30 16:11:01 +02:00

qpolicy.c

net: dccp: Fix most of the kerneldoc warnings

2020-10-30 12:08:54 -07:00

sysctl.c

proc/sysctl: add shared variables for range check

2019-07-18 17:08:07 -07:00

timer.c

net: sock: introduce sk_error_report

2021-06-29 11:28:21 -07:00

trace.h

net: dccp: Use memset_startat() for TP zeroing

2021-11-19 11:22:49 +00:00