Sabrina Dubroca 3cb00b90e8 net: add recursion limit to GRO ... [ Upstream commit fcd91dd449867c6bfe56a81cabba76b829fd05cd ] Currently, GRO can do unlimited recursion through the gro_receive handlers. This was fixed for tunneling protocols by limiting tunnel GRO to one level with encap_mark, but both VLAN and TEB still have this problem. Thus, the kernel is vulnerable to a stack overflow, if we receive a packet composed entirely of VLAN headers. This patch adds a recursion counter to the GRO layer to prevent stack overflow. When a gro_receive function hits the recursion limit, GRO is aborted for this skb and it is processed normally. This recursion counter is put in the GRO CB, but could be turned into a percpu counter if we run out of space in the CB. Thanks to Vladimír Beneš <vbenes@redhat.com> for the initial bug report. Fixes: CVE-2016-7039 Fixes: 9b174d88c2 ("net: Add Transparent Ethernet Bridging GRO support.") Fixes: 66e5133f19 ("vlan: Add GRO support for non hardware accelerated vlan") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Jiri Benc <jbenc@redhat.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Acked-by: Tom Herbert <tom@herbertland.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2016-11-15 07:46:38 +01:00
..
netfilter	netfilter: x_tables: introduce and use xt_copy_counters_from_user	2016-06-24 10:18:24 -07:00
af_inet.c	net: add recursion limit to GRO	2016-11-15 07:46:38 +01:00
ah4.c	ah4: Fix error return in ah_input().	2015-08-25 13:38:50 -07:00
arp.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-10-20 06:08:27 -07:00
cipso_ipv4.c
datagram.c	net: Set sk_txhash from a random number	2015-07-29 22:44:04 -07:00
devinet.c	ipv4: Don't do expensive useless work during inetdev destroy.	2016-04-20 15:42:03 +09:00
esp4.c	esp: Fix ESN generation under UDP encapsulation	2016-07-11 09:31:11 -07:00
fib_frontend.c	ipv4/fib: don't warn when primary address is missing if in_dev is dead	2016-05-18 17:06:36 -07:00
fib_lookup.h	ipv4: consider TOS in fib_select_default	2015-07-24 22:46:11 -07:00
fib_rules.c	net: ipv6: use common fib_default_rule_pref	2015-09-09 14:19:50 -07:00
fib_semantics.c	ipv4: reject RTNH_F_DEAD and RTNH_F_LINKDOWN from user space	2016-08-16 09:30:47 +02:00
fib_trie.c	ipv4: panic in leaf_walk_rcu due to stale node pointer	2016-09-30 10:18:34 +02:00
fou.c	net: add recursion limit to GRO	2016-11-15 07:46:38 +01:00
gre_demux.c	gre: Remove support for sharing GRE protocol hook.	2015-08-10 14:03:54 -07:00
gre_offload.c	net: add recursion limit to GRO	2016-11-15 07:46:38 +01:00
icmp.c	Revert "ipv4/icmp: redirect messages can use the ingress daddr as source"	2015-10-14 06:01:07 -07:00
igmp.c	mld, igmp: Fix reserved tailroom calculation	2016-04-20 15:41:58 +09:00
inet_connection_sock.c	tcp/dccp: fix another race at listener dismantle	2016-03-03 15:07:07 -08:00
inet_diag.c	tcp/dccp: install syn_recv requests into ehash table	2015-10-03 04:32:41 -07:00
inet_fragment.c	net: fix percpu memory leaks	2015-11-02 22:47:14 -05:00
inet_hashtables.c	tcp/dccp: fix hashdance race for passive sessions	2015-10-23 05:42:21 -07:00
inet_lro.c
inet_timewait_sock.c	tcp/dccp: fix timewait races in timer handling	2015-09-21 16:32:29 -07:00
inetpeer.c	net: Add helper function to compare inetpeer addresses	2015-08-28 13:32:36 -07:00
ip_forward.c	net: Pass net into dst_output and remove dst_output_okfn	2015-10-08 04:26:54 -07:00
ip_fragment.c	inet: frag: Always orphan skbs inside ip_defrag()	2016-03-03 15:07:04 -08:00
ip_gre.c	vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices	2016-06-24 10:18:18 -07:00
ip_input.c	ipv4: Pass struct net into ip_defrag and ip_check_defrag	2015-10-12 19:44:16 -07:00
ip_options.c
ip_output.c	ipv4: only create late gso-skb if skb is already set up with CHECKSUM_PARTIAL	2016-04-20 15:41:57 +09:00
ip_sockglue.c	ipv4: fix memory leaks in ip_cmsg_send() callers	2016-03-03 15:07:06 -08:00
ip_tunnel.c	vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices	2016-06-24 10:18:18 -07:00
ip_tunnel_core.c	tunnels: Remove encapsulation offloads on decap.	2016-10-31 04:13:59 -06:00
ip_vti.c	vti: flush x-netns xfrm cache when vti interface is removed	2016-09-30 10:18:36 +02:00
ipcomp.c
ipconfig.c	ipconfig: send Client-identifier in DHCP requests	2015-10-18 19:23:52 -07:00
ipip.c	ipip: ioctl: Remove superfluous IP-TTL handling.	2015-12-18 16:07:59 -05:00
ipmr.c	ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route	2016-11-15 07:46:37 +01:00
Kconfig	geneve: Consolidate Geneve functionality in single module.	2015-08-27 15:42:48 -07:00
Makefile	tcp: track the packet timings in RACK	2015-10-21 07:00:48 -07:00
netfilter.c	ipv4: Pass struct net into ip_route_me_harder	2015-09-29 20:21:32 +02:00
ping.c	ipv4: fix memory leaks in ip_cmsg_send() callers	2016-03-03 15:07:06 -08:00
proc.c	net: track success and failure of TCP PMTU probing	2015-07-21 22:36:33 -07:00
protocol.c
raw.c	ipv4: fix memory leaks in ip_cmsg_send() callers	2016-03-03 15:07:06 -08:00
route.c	ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route	2016-11-15 07:46:37 +01:00
syncookies.c	tcp/dccp: fix hashdance race for passive sessions	2015-10-23 05:42:21 -07:00
sysctl_net_ipv4.c	ipv4: disable BH when changing ip local port range	2015-11-04 21:29:06 -05:00
tcp.c	net:Add sysctl_max_skb_frags	2016-03-03 15:07:05 -08:00
tcp_bic.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_cdg.c	tcp: do not slow start when cwnd equals ssthresh	2015-07-09 14:22:52 -07:00
tcp_cong.c	tcp: remove tcp_ecn_make_synack() socket argument	2015-09-25 13:00:38 -07:00
tcp_cubic.c	tcp_cubic: do not set epoch_start in the future	2015-09-17 22:35:07 -07:00
tcp_dctcp.c	tcp: allow dctcp alpha to drop to zero	2015-10-23 02:46:52 -07:00
tcp_diag.c	tcp: ensure proper barriers in lockless contexts	2015-11-15 18:36:38 -05:00
tcp_fastopen.c	tcp/dccp: fix hashdance race for passive sessions	2015-10-23 05:42:21 -07:00
tcp_highspeed.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_htcp.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_hybla.c	tcp: do not slow start when cwnd equals ssthresh	2015-07-09 14:22:52 -07:00
tcp_illinois.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_input.c	tcp: fix a compile error in DBGUNDO()	2016-11-15 07:46:36 +01:00
tcp_ipv4.c	tcp: properly scale window in tcp_v[46]_reqsk_send_ack()	2016-09-30 10:18:34 +02:00
tcp_lp.c
tcp_memcontrol.c
tcp_metrics.c	tcp: convert cached rtt from usec to jiffies when feeding initial rto	2016-04-20 15:41:56 +09:00
tcp_minisocks.c	tcp: fix tcpi_segs_in after connection establishment	2016-04-20 15:42:00 +09:00
tcp_offload.c
tcp_output.c	tcp: fix wrong checksum calculation on MTU probing	2016-11-15 07:46:36 +01:00
tcp_probe.c
tcp_recovery.c	tcp: use RACK to detect losses	2015-10-21 07:00:53 -07:00
tcp_scalable.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_timer.c	tcp: fix Fast Open snmp over-counting bug	2015-11-20 10:51:12 -05:00
tcp_vegas.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_vegas.h
tcp_veno.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_westwood.c
tcp_yeah.c	tcp: cwnd does not increase in TCP YeAH	2016-09-30 10:18:34 +02:00
tunnel4.c
udp.c	udp: properly support MSG_PEEK with truncated buffers	2016-09-15 08:27:49 +02:00
udp_diag.c
udp_impl.h
udp_offload.c	net: add recursion limit to GRO	2016-11-15 07:46:38 +01:00
udp_tunnel.c	tunnel: Clear IPCB(skb)->opt before dst_link_failure called	2016-04-20 15:41:56 +09:00
udplite.c
xfrm4_input.c	netfilter: Pass net into okfn	2015-09-17 17:18:37 -07:00
xfrm4_mode_beet.c
xfrm4_mode_transport.c
xfrm4_mode_tunnel.c
xfrm4_output.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-10-24 06:54:12 -07:00
xfrm4_policy.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2015-12-22 16:26:31 -05:00
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c