Maxim Mikityanskiy 4cefa061fc sch_cake: Fix out of bounds when parsing TCP options and header ... [ Upstream commit ba91c49dedbde758ba0b72f57ac90b06ddf8e548 ] The TCP option parser in cake qdisc (cake_get_tcpopt and cake_tcph_may_drop) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the length of 1. This fix is inspired by commit 9609dad263 ("ipv4: tcp_input: fix stack out of bounds when parsing TCP options."). v2 changes: Added doff validation in cake_get_tcphdr to avoid parsing garbage as TCP header. Although it wasn't strictly an out-of-bounds access (memory was allocated), garbage values could be read where CAKE expected the TCP header if doff was smaller than 5. Cc: Young Xiao <92siuyang@gmail.com> Fixes: 8b7138814f ("sch_cake: Add optional ACK filter") Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-06-23 14:41:25 +02:00
..
act_api.c	net: sched: bump refcount for new action in ACT replace mode	2021-04-14 08:24:18 +02:00
act_bpf.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_connmark.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_csum.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_ct.c	net/sched: act_ct: handle DNAT tuple collision	2021-06-23 14:41:24 +02:00
act_ctinfo.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_gact.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_ife.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_ipt.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_meta_mark.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
act_meta_skbprio.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
act_meta_skbtcindex.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
act_mirred.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_mpls.c	net/sched: act_mpls: ensure LSE is pullable before reading it	2020-12-08 10:40:27 +01:00
act_nat.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_pedit.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_police.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_sample.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_simple.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_skbedit.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_skbmod.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
act_tunnel_key.c	net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels	2020-10-29 09:57:26 +01:00
act_vlan.c	net_sched: defer tcf_idr_insert() in tcf_action_init_1()	2020-10-14 10:33:06 +02:00
cls_api.c	net: sched: fix police ext initialization	2021-03-04 10:26:53 +01:00
cls_basic.c	net_sched: fix ops->bind_class() implementations	2020-02-01 09:34:38 +00:00
cls_bpf.c	net_sched: fix ops->bind_class() implementations	2020-02-01 09:34:38 +00:00
cls_cgroup.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
cls_flow.c	sched: consistently handle layer3 header accesses in the presence of VLANs	2020-07-22 09:32:48 +02:00
cls_flower.c	sched: consistently handle layer3 header accesses in the presence of VLANs	2020-07-22 09:32:48 +02:00
cls_fw.c	net_sched: fix ops->bind_class() implementations	2020-02-01 09:34:38 +00:00
cls_matchall.c	net/sched: matchall: add missing validation of TCA_MATCHALL_FLAGS	2020-02-24 08:36:22 +01:00
cls_route.c	net_sched: cls_route: remove the right filter from hashtable	2020-04-01 11:01:36 +02:00
cls_rsvp.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
cls_rsvp.h	cls_rsvp: fix rsvp_policy	2020-02-11 04:35:03 -08:00
cls_rsvp6.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
cls_tcindex.c	net_sched: avoid shift-out-of-bounds in tcindex_set_parms()	2021-01-27 11:47:54 +01:00
cls_u32.c	net_sched: fix ops->bind_class() implementations	2020-02-01 09:34:38 +00:00
em_canid.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 11	2019-05-21 11:28:45 +02:00
em_cmp.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
em_ipset.c	sched: consistently handle layer3 header accesses in the presence of VLANs	2020-07-22 09:32:48 +02:00
em_ipt.c	sched: consistently handle layer3 header accesses in the presence of VLANs	2020-07-22 09:32:48 +02:00
em_meta.c	sched: consistently handle layer3 header accesses in the presence of VLANs	2020-07-22 09:32:48 +02:00
em_nbyte.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
em_text.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
em_u32.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
ematch.c	net_sched: ematch: reject invalid TCF_EM_SIMPLE	2020-02-01 09:34:38 +00:00
Kconfig	net/sched: Set default of CONFIG_NET_TC_SKB_EXT to N	2019-09-27 20:08:28 +02:00
Makefile	net/sched: Introduce action ct	2019-07-09 12:11:59 -07:00
sch_api.c	net: sched: avoid duplicates in classes dump	2021-03-17 17:03:35 +01:00
sch_atm.c	net_sched: fix a memory leak in atm_tc_init()	2020-07-22 09:32:48 +02:00
sch_blackhole.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sch_cake.c	sch_cake: Fix out of bounds when parsing TCP options and header	2021-06-23 14:41:25 +02:00
sch_cbq.c	sch_cbq: validate TCA_CBQ_WRROPT to avoid crash	2019-09-30 11:07:46 -07:00
sch_cbs.c	net: cbs: Fix software cbs to consider packet sending time	2020-04-01 11:01:33 +02:00
sch_choke.c	net: sched: validate stab values	2021-03-30 14:35:25 +02:00
sch_codel.c	net: sched: Fix a possible null-pointer dereference in dequeue_func()	2019-07-29 09:46:58 -07:00
sch_drr.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
sch_dsmark.c	sch_dsmark: fix a NULL deref in qdisc_reset()	2021-06-03 08:59:15 +02:00
sch_etf.c	sched: etf: do not assume all sockets are full blown	2020-04-29 16:33:09 +02:00
sch_fifo.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sch_fq_codel.c	fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks	2020-05-14 07:58:20 +02:00
sch_fq.c	net: fq: add missing attribute validation for orphan mask	2020-03-18 07:17:45 +01:00
sch_generic.c	net: sched: fix tx action reschedule issue with stopped queue	2021-06-03 08:59:13 +02:00
sch_gred.c	net: sched: validate stab values	2021-03-30 14:35:25 +02:00
sch_hfsc.c	netlink: make validation more configurable for future strictness	2019-04-27 17:07:21 -04:00
sch_hhf.c	net/flow_dissector: switch to siphash	2019-10-23 20:13:22 -07:00
sch_htb.c	net: sched: sch_htb: don't call qdisc_put() while holding tree lock	2019-09-27 12:13:55 +02:00
sch_ingress.c	net: flow_offload: rename TCF_BLOCK_BINDER_TYPE_* to FLOW_BLOCK_BINDER_TYPE_*	2019-07-09 14:38:50 -07:00
sch_mq.c	net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues	2019-12-18 16:08:24 +01:00
sch_mqprio.c	net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues	2019-12-18 16:08:24 +01:00
sch_multiq.c	net: sched: fix tc -s class show no bstats on class with nolock subqueues	2019-12-04 22:30:54 +01:00
sch_netem.c	netem: fix zero division in tabledist	2020-11-01 12:01:03 +01:00
sch_pie.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 235	2019-06-19 17:09:07 +02:00
sch_plug.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sch_prio.c	net: sch_prio: When ungrafting, replace with FIFO	2020-01-12 12:21:49 +01:00
sch_qfq.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
sch_red.c	net: sched: validate stab values	2021-03-30 14:35:25 +02:00
sch_sfb.c	net/flow_dissector: switch to siphash	2019-10-23 20:13:22 -07:00
sch_sfq.c	net: sched: validate stab values	2021-03-30 14:35:25 +02:00
sch_skbprio.c	net_sched: sch_skbprio: add message validation to skbprio_change()	2020-05-14 07:58:21 +02:00
sch_taprio.c	net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule	2021-05-19 10:08:23 +02:00
sch_tbf.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sch_teql.c	net: sched: sch_teql: fix null-pointer dereference	2021-04-14 08:24:12 +02:00