Miaohe Lin d84e9d3c97 net: sit: fix UBSAN Undefined behaviour in check_6rd ... [ Upstream commit a843dc4ebaecd15fca1f4d35a97210f72ea1473b ] In func check_6rd,tunnel->ip6rd.relay_prefixlen may equal to 32,so UBSAN complain about it. UBSAN: Undefined behaviour in net/ipv6/sit.c:781:47 shift exponent 32 is too large for 32-bit type 'unsigned int' CPU: 6 PID: 20036 Comm: syz-executor.0 Not tainted 4.19.27 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 ubsan_epilogue+0xe/0x81 lib/ubsan.c:159 __ubsan_handle_shift_out_of_bounds+0x293/0x2e8 lib/ubsan.c:425 check_6rd.constprop.9+0x433/0x4e0 net/ipv6/sit.c:781 try_6rd net/ipv6/sit.c:806 [inline] ipip6_tunnel_xmit net/ipv6/sit.c:866 [inline] sit_tunnel_xmit+0x141c/0x2720 net/ipv6/sit.c:1033 __netdev_start_xmit include/linux/netdevice.h:4300 [inline] netdev_start_xmit include/linux/netdevice.h:4309 [inline] xmit_one net/core/dev.c:3243 [inline] dev_hard_start_xmit+0x17c/0x780 net/core/dev.c:3259 __dev_queue_xmit+0x1656/0x2500 net/core/dev.c:3829 neigh_output include/net/neighbour.h:501 [inline] ip6_finish_output2+0xa36/0x2290 net/ipv6/ip6_output.c:120 ip6_finish_output+0x3e7/0xa20 net/ipv6/ip6_output.c:154 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x1e2/0x720 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:444 [inline] ip6_local_out+0x99/0x170 net/ipv6/output_core.c:176 ip6_send_skb+0x9d/0x2f0 net/ipv6/ip6_output.c:1697 ip6_push_pending_frames+0xc0/0x100 net/ipv6/ip6_output.c:1717 rawv6_push_pending_frames net/ipv6/raw.c:616 [inline] rawv6_sendmsg+0x2435/0x3530 net/ipv6/raw.c:946 inet_sendmsg+0xf8/0x5c0 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg+0xc8/0x110 net/socket.c:631 ___sys_sendmsg+0x6cf/0x890 net/socket.c:2114 __sys_sendmsg+0xf0/0x1b0 net/socket.c:2152 do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Signed-off-by: linmiaohe <linmiaohe@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-03-23 08:44:29 +01:00
..
6lowpan	6lowpan: iphc: reset mac_header after decompress to fix panic	2018-10-10 08:52:04 +02:00
9p	9p/net: put a lower bound on msize	2019-01-13 10:05:33 +01:00
802
8021q
appletalk
atm
ax25	ax25: fix possible use-after-free	2019-02-23 09:05:14 +01:00
batman-adv	batman-adv: fix uninit-value in batadv_interface_tx()	2019-03-23 08:44:17 +01:00
bluetooth	Bluetooth: Fix unnecessary error message for HCI request completion	2019-02-20 10:13:10 +01:00
bridge	netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES	2019-03-23 08:44:29 +01:00
caif	net: caif: Add a missing rcu_read_unlock() in caif_flow_cb	2018-09-05 09:18:34 +02:00
can	can: bcm: check timer values before ktime conversion	2019-02-06 19:43:04 +01:00
ceph	libceph: handle an empty authorize reply	2019-03-23 08:44:18 +01:00
core	net-sysfs: Fix mem leak in netdev_register_kobject	2019-03-23 08:44:22 +01:00
dcb	net: dcb: For wild-card lookups, use priority -1, not 0	2018-09-19 22:48:58 +02:00
dccp	dccp: fool proof ccid_hc_[rt]x_parse_options()	2019-02-20 10:13:15 +01:00
decnet
dns_resolver
dsa	net: dsa: slave: Don't propagate flag changes on down slave interfaces	2019-02-20 10:13:15 +01:00
ethernet
hsr	net: hsr: fix memory leak in hsr_dev_finalize()	2019-03-23 08:44:29 +01:00
ieee802154	inet: frags: fix ip6frag_low_thresh boundary	2019-02-08 11:25:32 +01:00
ipv4	netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES	2019-03-23 08:44:29 +01:00
ipv6	net: sit: fix UBSAN Undefined behaviour in check_6rd	2019-03-23 08:44:29 +01:00
ipx
irda	irda: Only insert new objects into the global database via setsockopt	2018-09-15 09:40:40 +02:00
iucv	af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers	2018-11-10 07:41:35 -08:00
key
l2tp	l2tp: fix infoleak in l2tp_ip6_recvmsg()	2019-03-23 08:44:29 +01:00
l3mdev
lapb
llc	llc: do not use sk_eat_skb()	2018-12-01 09:46:34 +01:00
mac80211	mac80211: don't initiate TDLS connection if station is not associated to AP	2019-03-23 08:44:20 +01:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-09-09 20:04:32 +02:00
mpls
netfilter	netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options	2019-03-23 08:44:29 +01:00
netlabel	netlabel: check for IPV4MASK in addrinfo_get	2018-10-20 09:52:36 +02:00
netlink	netlink: Don't shift on 64 for ngroups	2018-08-09 12:19:28 +02:00
netrom	netrom: switch to sock timer API	2019-02-06 19:43:06 +01:00
nfc	net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails	2019-03-23 08:44:22 +01:00
openvswitch	openvswitch: Avoid OOB read when parsing flow nlattrs	2019-02-06 19:43:03 +01:00
packet	net/packet: fix 4gb buffer limit due to overflow check	2019-03-23 08:44:17 +01:00
phonet
rds	rds: avoid unenecessary cong_update in loop transport	2018-07-22 14:25:54 +02:00
rfkill
rose	net/rose: fix NULL ax25_cb kernel panic	2019-02-06 19:43:06 +01:00
rxrpc
sched	net_sched: refetch skb protocol for each filter	2019-02-06 19:43:03 +01:00
sctp	sctp: allocate sctp_sockaddr_entry with kzalloc	2019-01-26 09:42:51 +01:00
sunrpc	sunrpc: handle ENOMEM in rpcb_getport_async	2019-01-26 09:42:51 +01:00
switchdev
tipc	tipc: use destination length for copy string	2019-02-20 10:13:14 +01:00
unix	net: drop write-only stack variable	2018-11-10 07:41:34 -08:00
vmw_vsock	vsock: cope with memory allocation failure at socket creation time	2019-02-23 09:05:13 +01:00
wimax
wireless	cfg80211: extend range deviation for DMG	2019-03-23 08:44:20 +01:00
x25	net/x25: do not hold the cpu too long in x25_new_lci()	2019-02-23 09:05:14 +01:00
xfrm	xfrm: refine validation of template and selector families	2019-02-20 10:13:20 +01:00
compat.c	sock: Make sock->sk_stamp thread-safe	2019-01-13 10:05:28 +01:00
Kconfig
Makefile
socket.c	sockfs: getxattr: Fail with -EOPNOTSUPP for invalid attribute names	2019-03-23 08:44:21 +01:00
sysctl_net.c