diff options
| author | Willem de Bruijn <willemb@google.com> | 2020-05-04 18:48:54 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2020-05-07 02:23:06 +0200 |
| commit | 9274124f023b5c56dc4326637d4f787968b03607 (patch) | |
| tree | 0f46c00bd05149b9747ab50c1e290a56fb7b5ee6 /samples/qmi | |
| parent | seg6: fix SRH processing to comply with RFC8754 (diff) | |
| download | linux-9274124f023b5c56dc4326637d4f787968b03607.tar.xz linux-9274124f023b5c56dc4326637d4f787968b03607.zip | |
net: stricter validation of untrusted gso packets
Syzkaller again found a path to a kernel crash through bad gso input:
a packet with transport header extending beyond skb_headlen(skb).
Tighten validation at kernel entry:
- Verify that the transport header lies within the linear section.
To avoid pulling linux/tcp.h, verify just sizeof tcphdr.
tcp_gso_segment will call pskb_may_pull (th->doff * 4) before use.
- Match the gso_type against the ip_proto found by the flow dissector.
Fixes: bfd5f4a3d605 ("packet: Add GSO/csum offload support.")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'samples/qmi')
0 files changed, 0 insertions, 0 deletions