Michal Kubeček 3de81b7588 tipc: check minimum bearer MTU ... Qian Zhang (张谦) reported a potential socket buffer overflow in tipc_msg_build() which is also known as CVE-2016-8632: due to insufficient checks, a buffer overflow can occur if MTU is too short for even tipc headers. As anyone can set device MTU in a user/net namespace, this issue can be abused by a regular user. As agreed in the discussion on Ben Hutchings' original patch, we should check the MTU at the moment a bearer is attached rather than for each processed packet. We also need to repeat the check when bearer MTU is adjusted to new device MTU. UDP case also needs a check to avoid overflow when calculating bearer MTU. Fixes: b97bf3fd8f ("[TIPC] Initial merge") Signed-off-by: Michal Kubecek <mkubecek@suse.cz> Reported-by: Qian Zhang (张谦) <zhangqian-c@360.cn> Acked-by: Ying Xue <ying.xue@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-12-02 14:03:20 -05:00
..
addr.c
addr.h
bcast.c	tipc: fix broadcast link synchronization problem	2016-10-29 17:21:09 -04:00
bcast.h	tipc: fix broadcast link synchronization problem	2016-10-29 17:21:09 -04:00
bearer.c	tipc: check minimum bearer MTU	2016-12-02 14:03:20 -05:00
bearer.h	tipc: check minimum bearer MTU	2016-12-02 14:03:20 -05:00
core.c
core.h
discover.c
discover.h
eth_media.c
ib_media.c
Kconfig
link.c	tipc: fix link statistics counter errors	2016-11-27 20:35:55 -05:00
link.h
Makefile
monitor.c	tipc: improve sanity check for received domain records	2016-11-25 20:06:18 -05:00
monitor.h
msg.c
msg.h	tipc: fix broadcast link synchronization problem	2016-10-29 17:21:09 -04:00
name_distr.c	tipc: fix broadcast link synchronization problem	2016-10-29 17:21:09 -04:00
name_distr.h
name_table.c
name_table.h
net.c
net.h
netlink_compat.c
netlink.c
netlink.h
node.c	tipc: fix broadcast link synchronization problem	2016-10-29 17:21:09 -04:00
node.h
server.c
server.h
socket.c	tipc: resolve connection flow control compatibility problem	2016-11-25 21:38:16 -05:00
socket.h
subscr.c
subscr.h
sysctl.c
udp_media.c	tipc: check minimum bearer MTU	2016-12-02 14:03:20 -05:00
udp_media.h