Skip to content

K
Kernel

openeuler / Kernel
1 年多 前同步成功

通知 8
Star 0
Fork 0
K
Kernel
切换分支/标签
  1. 06 8月, 2013 1 次提交
    • D
      net: esp{4,6}: fix potential MTU calculation overflows · 7921895a
      由 Daniel Borkmann 提交于 
      Commit 91657eaf ("xfrm: take net hdr len into account for esp payload
size calculation") introduced a possible interger overflow in
esp{4,6}_get_mtu() handlers in case of x->props.mode equals
XFRM_MODE_TUNNEL. Thus, the following expression will overflow

  unsigned int net_adj;
  ...
  <case ipv{4,6} XFRM_MODE_TUNNEL>
         net_adj = 0;
  ...
  return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
           net_adj) & ~(align - 1)) + (net_adj - 2);

where (net_adj - 2) would be evaluated as <foo> + (0 - 2) in an unsigned
context. Fix it by simply removing brackets as those operations here
do not need to have special precedence.
Signed-off-by: NDaniel Borkmann <dborkman@redhat.com>
Cc: Benjamin Poirier <bpoirier@suse.de>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: NBenjamin Poirier <bpoirier@suse.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      7921895a
  3. 08 1月, 2013 1 次提交
  5. 01 9月, 2012 1 次提交
  7. 12 7月, 2012 1 次提交
  9. 16 6月, 2012 1 次提交
    • D
      ipv6: Handle PMTU in ICMP error handlers. · 81aded24
      由 David S. Miller 提交于 
      One tricky issue on the ipv6 side vs. ipv4 is that the ICMP callouts
to handle the error pass the 32-bit info cookie in network byte order
whereas ipv4 passes it around in host byte order.

Like the ipv4 side, we have two helper functions.  One for when we
have a socket context and one for when we do not.

ip6ip6 tunnels are not handled here, because they handle PMTU events
by essentially relaying another ICMP packet-too-big message back to
the original sender.

This patch allows us to get rid of rt6_do_pmtu_disc().  It handles all
kinds of situations that simply cannot happen when we do the PMTU
update directly using a fully resolved route.

In fact, the "plen == 128" check in ip6_rt_update_pmtu() can very
likely be removed or changed into a BUG_ON() check.  We should never
have a prefixed ipv6 route when we get there.

Another piece of strange history here is that TCP and DCCP, unlike in
ipv4, never invoke the update_pmtu() method from their ICMP error
handlers.  This is incredibly astonishing since this is the context
where we have the most accurate context in which to make a PMTU
update, namely we have a fully connected socket and associated cached
socket route.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      81aded24
  11. 27 5月, 2012 1 次提交
  13. 16 5月, 2012 2 次提交
  15. 27 4月, 2011 1 次提交
  17. 23 4月, 2011 1 次提交
  19. 14 3月, 2011 2 次提交
  21. 11 12月, 2010 1 次提交
  23. 23 2月, 2010 1 次提交
  25. 26 11月, 2009 1 次提交
  27. 15 9月, 2009 1 次提交
  29. 23 6月, 2009 1 次提交
  31. 26 11月, 2008 2 次提交
  33. 30 10月, 2008 1 次提交
  35. 29 10月, 2008 1 次提交
  37. 06 8月, 2008 1 次提交
  39. 28 3月, 2008 1 次提交
  41. 13 2月, 2008 1 次提交
  43. 01 2月, 2008 3 次提交
  45. 29 1月, 2008 4 次提交
  47. 11 12月, 2007 1 次提交
  49. 31 10月, 2007 1 次提交
    • D
      [NET]: Fix incorrect sg_mark_end() calls. · 51c739d1
      由 David S. Miller 提交于 
      This fixes scatterlist corruptions added by

	commit 68e3f5dd
	[CRYPTO] users: Fix up scatterlist conversion errors

The issue is that the code calls sg_mark_end() which clobbers the
sg_page() pointer of the final scatterlist entry.

The first part fo the fix makes skb_to_sgvec() do __sg_mark_end().

After considering all skb_to_sgvec() call sites the most correct
solution is to call __sg_mark_end() in skb_to_sgvec() since that is
what all of the callers would end up doing anyways.

I suspect this might have fixed some problems in virtio_net which is
the sole non-crypto user of skb_to_sgvec().

Other similar sg_mark_end() cases were converted over to
__sg_mark_end() as well.

Arguably sg_mark_end() is a poorly named function because it doesn't
just "mark", it clears out the page pointer as a side effect, which is
what led to these bugs in the first place.

The one remaining plain sg_mark_end() call is in scsi_alloc_sgtable()
and arguably it could be converted to __sg_mark_end() if only so that
we can delete this confusing interface from linux/scatterlist.h
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      51c739d1
  51. 27 10月, 2007 2 次提交
  53. 26 10月, 2007 1 次提交
  55. 22 10月, 2007 1 次提交
  57. 18 10月, 2007 1 次提交
  59. 11 10月, 2007 2 次提交