MoYuanhao 7ac2535d8e tcp: check space before adding MPTCP SYN options ...

commit 06d64ab46f upstream.

Ensure there is enough space before adding MPTCP options in
tcp_syn_options().

Without this check, 'remaining' could underflow, and causes issues. If
there is not enough space, MPTCP should not be used.

Signed-off-by: MoYuanhao <moyuanhao3676@163.com>
Fixes: cec37a6e41 ("mptcp: Handle MP_CAPABLE options for outgoing connections")
Cc: stable@vger.kernel.org
Acked-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
[ Matt: Add Fixes, cc Stable, update Description ]
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20241209-net-mptcp-check-space-syn-v1-1-2da992bb6f74@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2024-12-19 18:11:21 +01:00

..

6lowpan

…

9p

9p/xen: fix release of IRQ

2024-12-09 10:32:57 +01:00

802

…

8021q

net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb

2024-05-17 12:02:07 +02:00

appletalk

appletalk: Fix Use-After-Free in atalk_ioctl

2023-12-20 17:01:50 +01:00

atm

atm: Fix Use-After-Free in do_vcc_ioctl

2023-12-20 17:01:48 +01:00

ax25

ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put()

2024-06-21 14:38:14 +02:00

batman-adv

batman-adv: Don't accept TT entries for out-of-spec VIDs

2024-07-05 09:34:04 +02:00

bluetooth

Bluetooth: Support new quirks for ATS2851

2024-12-14 20:00:09 +01:00

bpf

bpf, test_run: Fix LIVE_FRAME frame update after a page has been recycled

2024-11-08 16:28:19 +01:00

bpfilter

…

bridge

bridge: Handle error of rtnl_register_module().

2024-10-17 15:24:29 +02:00

caif

sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)

2023-06-24 15:50:13 -07:00

can

net: af_can: do not leave a dangling sk pointer in can_create()

2024-12-14 20:00:04 +01:00

ceph

libceph: init the cursor when preparing sparse read in msgr2

2024-10-17 15:24:10 +02:00

core

netpoll: Use rcu_access_pointer() in __netpoll_setup

2024-12-14 20:00:10 +01:00

dcb

net: dcb: choose correct policy to parse DCB_ATTR_BCN

2023-08-01 21:07:46 -07:00

dccp

dccp: Fix memory leak in dccp_feat_change_recv

2024-12-14 19:59:36 +01:00

devlink

devlink: fix port new reply cmd type

2024-03-26 18:20:11 -04:00

dns_resolver

keys, dns: Fix size check of V1 server-list header

2024-01-25 15:35:41 -08:00

dsa

net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events

2024-10-10 11:58:07 +02:00

ethernet

ethernet: Add helper for assigning packet type when dest address does not match device address

2024-05-02 16:32:46 +02:00

ethtool

ethtool: Fix wrong mod state in case of verbose and no_mask bitset

2024-12-14 19:59:39 +01:00

handshake

net/handshake: Fix handshake_req_destroy_test1

2024-02-23 09:24:50 +01:00

hsr

net: hsr: avoid potential out-of-bound access in fill_frame_info()

2024-12-14 19:59:34 +01:00

ieee802154

net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()

2024-12-14 20:00:04 +01:00

ife

net: sched: ife: fix potential use-after-free

2024-01-01 12:42:30 +00:00

ipv4

tcp: check space before adding MPTCP SYN options

2024-12-19 18:11:21 +01:00

ipv6

net: inet6: do not leave a dangling sk pointer in inet6_create()

2024-12-14 20:00:04 +01:00

iucv

s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()

2024-12-09 10:32:33 +01:00

kcm

kcm: Serialise kcm_sendmsg() for the same socket.

2024-08-29 17:33:46 +02:00

key

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2023-08-18 12:44:56 -07:00

l2tp

ipv6: introduce dst_rt6_info() helper

2024-12-14 19:59:35 +01:00

l3mdev

…

lapb

…

llc

llc: Improve setsockopt() handling of malformed user input

2024-12-09 10:32:35 +01:00

mac80211

mac80211: fix user-power when emulating chanctx

2024-12-09 10:31:36 +01:00

mac802154

mac802154: Fix potential RCU dereference issue in mac802154_scan_worker

2024-10-10 11:57:59 +02:00

mctp

mctp: Handle error of rtnl_register_module().

2024-10-17 15:24:29 +02:00

mpls

ipv6: introduce dst_rt6_info() helper

2024-12-14 19:59:35 +01:00

mptcp

mptcp: fix possible integer overflow in mptcp_reset_tout_timer

2024-12-09 10:31:42 +01:00

ncsi

net/ncsi: Fix the multi thread manner of NCSI driver

2024-06-21 14:38:14 +02:00

netfilter

netfilter: nft_set_hash: skip duplicated elements pending gc run

2024-12-14 19:59:38 +01:00

netlabel

calipso: fix memory leak in netlbl_calipso_add_pass()

2024-01-25 15:35:14 -08:00

netlink

sock_diag: add module pointer to "struct sock_diag_handler"

2024-12-09 10:32:09 +01:00

netrom

netrom: Fix a memory leak in nr_heartbeat_expiry()

2024-06-27 13:49:06 +02:00

nfc

nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies

2024-08-19 06:04:28 +02:00

nsh

nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().

2024-05-17 12:02:02 +02:00

openvswitch

net: ovs: fix ovs_drop_reasons error

2024-08-29 17:33:50 +02:00

packet

af_packet: avoid erroring out after sock_init_data() in packet_create()

2024-12-14 20:00:04 +01:00

phonet

phonet: Handle error of rtnl_register_module().

2024-10-17 15:24:30 +02:00

psample

psample: Require 'CAP_NET_ADMIN' when joining "packets" group

2023-12-13 18:45:10 +01:00

qrtr

net: qrtr: Update packets cloning when broadcasting

2024-10-04 16:29:41 +02:00

rds

net:rds: Fix possible deadlock in rds_message_put

2024-08-19 06:04:27 +02:00

rfkill

net: rfkill: gpio: Add check for clk_enable()

2024-12-09 10:32:11 +01:00

rose

net/rose: fix races in rose_kill_by_device()

2024-01-01 12:42:31 +00:00

rxrpc

rxrpc: Improve setsockopt() handling of malformed user input

2024-12-09 10:32:35 +01:00

sched

net/sched: cbs: Fix integer overflow in cbs_set_port_rate()

2024-12-14 20:00:03 +01:00

sctp

ipv6: introduce dst_rt6_info() helper

2024-12-14 19:59:35 +01:00

smc

net/smc: fix incorrect SMC-D link group matching logic

2024-12-14 20:00:22 +01:00

strparser

…

sunrpc

sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket

2024-12-09 10:33:00 +01:00

switchdev

net: bridge: switchdev: Skip MDB replays of deferred events on offload

2024-03-01 13:35:06 +01:00

tipc

tipc: Fix use-after-free of kernel socket in cleanup_bearer().

2024-12-14 19:59:36 +01:00

tls

tls: fix missing memory barrier in tls_init

2024-06-12 11:12:50 +02:00

unix

splice: do not checksum AF_UNIX sockets

2024-12-19 18:11:21 +01:00

vmw_vsock

bpf, vsock: Invoke proto::close on close()

2024-12-14 19:59:47 +01:00

wireless

wifi: cfg80211: clear wdev->cqm_config pointer on free

2024-11-08 16:28:23 +01:00

x25

net/x25: fix incorrect parameter validation in the x25_getsockopt() function

2024-03-26 18:19:41 -04:00

xdp

xsk: fix OOB map writes when deleting elements

2024-12-14 19:59:57 +01:00

xfrm

ipv6: introduce dst_rt6_info() helper

2024-12-14 19:59:35 +01:00

compat.c

…

devres.c

…

Kconfig

bpf: Add fd-based tcx multi-prog infra with link support

2023-07-19 10:07:27 -07:00

Kconfig.debug

…

Makefile

…

socket.c

net: explicitly clear the sk pointer, when pf->create fails

2024-10-17 15:24:35 +02:00

sysctl_net.c

sysctl: treewide: drop unused argument ctl_table_root::set_ownership(table)

2024-08-11 12:47:13 +02:00