Tobias Brunner 474d57adf1 af_key: Reject optional tunnel/BEET mode templates in outbound policies ... [ Upstream commit cf3128a7aca55b2eefb68281d44749c683bdc96f ] xfrm_state_find() uses `encap_family` of the current template with the passed local and remote addresses to find a matching state. If an optional tunnel or BEET mode template is skipped in a mixed-family scenario, there could be a mismatch causing an out-of-bounds read as the addresses were not replaced to match the family of the next template. While there are theoretical use cases for optional templates in outbound policies, the only practical one is to skip IPComp states in inbound policies if uncompressed packets are received that are handled by an implicitly created IPIP state instead. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Tobias Brunner <tobias@strongswan.org> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-05-24 17:32:43 +01:00
..
6lowpan
9p	9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition	2023-04-20 12:35:08 +02:00
802	mrp: introduce active flags to prevent UAF when applicant uninit	2022-12-31 13:33:02 +01:00
8021q	vlan: partially enable SIOCSHWTSTAMP in container	2023-05-11 23:03:18 +09:00
appletalk
atm	net/atm: fix proc_mpc_write incorrect return value	2022-10-15 11:08:36 +01:00
ax25
batman-adv
bluetooth	Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp	2023-05-24 17:32:40 +01:00
bpf	Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES"	2023-03-17 08:50:32 +01:00
bpfilter
bridge	net: add vlan_get_protocol_and_depth() helper	2023-05-24 17:32:32 +01:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:50:24 +01:00
can	can: isotp: isotp_recvmsg(): use sock_recv_cmsgs() to get SOCK_RXQ_OVFL infos	2023-04-13 16:55:33 +02:00
ceph	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
core	net: Catch invalid index in XPS mapping	2023-05-24 17:32:37 +01:00
dcb
dccp	netfilter: keep conntrack reference until IPsecv6 policy checks are done	2023-05-11 23:03:18 +09:00
dns_resolver
dsa	net: dsa: tag_brcm: legacy: fix daisy-chained switches	2023-03-30 12:49:09 +02:00
ethernet
ethtool	ethtool: Fix uninitialized number of lanes	2023-05-17 11:53:37 +02:00
hsr	hsr: ratelimit only when errors are printed	2023-04-06 12:10:58 +02:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-10-07 09:29:17 +02:00
ife
ipv4	tcp: add annotations around sk->sk_shutdown accesses	2023-05-24 17:32:32 +01:00
ipv6	net: ipv6: fix skb hash for some RST packets	2023-05-17 11:53:33 +02:00
iucv	net/iucv: Fix size of interrupt data	2023-03-22 13:33:50 +01:00
kcm	kcm: close race conditions on sk_receive_queue	2022-11-15 12:42:26 +01:00
key	af_key: Reject optional tunnel/BEET mode templates in outbound policies	2023-05-24 17:32:43 +01:00
l2tp	inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().	2023-04-26 14:28:43 +02:00
l3mdev
lapb
llc	net: deal with most data-races in sk_wait_event()	2023-05-24 17:32:32 +01:00
mac80211	wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta	2023-04-13 16:55:19 +02:00
mac802154	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()	2022-12-05 09:53:08 +01:00
mctp	net: mctp: purge receive queues on sk destruction	2023-02-06 08:06:34 +01:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-22 12:59:53 +01:00
mptcp	mptcp: fix accept vs worker race	2023-05-01 08:26:27 +09:00
ncsi	net/ncsi: clear Tx enable mode when handling a Config required AEN	2023-05-17 11:53:32 +02:00
netfilter	ipvs: Update width of source for ip_vs_sync_conn_options	2023-05-24 17:32:39 +01:00
netlabel
netlink	netlink: annotate accesses to nlk->cb_running	2023-05-24 17:32:32 +01:00
netrom	netrom: Fix use-after-free caused by accept on already connected socket	2023-02-09 11:28:06 +01:00
nfc	nfc: change order inside nfc_se_io error path	2023-03-17 08:50:17 +01:00
nsh
openvswitch	net: openvswitch: fix race on port output	2023-04-20 12:35:09 +02:00
packet	net: add vlan_get_protocol_and_depth() helper	2023-05-24 17:32:32 +01:00
phonet
psample
qrtr	net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()	2023-04-20 12:35:09 +02:00
rds	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()	2023-03-10 09:33:02 +01:00
rfkill
rose	net/rose: Fix to not accept on connected socket	2023-02-22 12:59:42 +01:00
rxrpc	rxrpc: Fix hard call timeout units	2023-05-17 11:53:35 +02:00
sched	net/sched: act_mirred: Add carrier check	2023-05-17 11:53:34 +02:00
sctp	sctp: Call inet6_destroy_sock() via sk->sk_destruct().	2023-04-26 14:28:43 +02:00
smc	net: deal with most data-races in sk_wait_event()	2023-05-24 17:32:32 +01:00
strparser
sunrpc	SUNRPC: remove the maximum number of retries in call_bind_status	2023-05-11 23:03:35 +09:00
switchdev
tipc	net: deal with most data-races in sk_wait_event()	2023-05-24 17:32:32 +01:00
tls	net: deal with most data-races in sk_wait_event()	2023-05-24 17:32:32 +01:00
unix	af_unix: Fix data races around sk->sk_shutdown.	2023-05-24 17:32:33 +01:00
vmw_vsock	net: vmw_vsock: vmci: Check memcpy_from_msg()	2022-12-31 13:32:26 +01:00
wireless	wifi: cfg80211: fix MLO connection ownership	2023-03-22 13:33:43 +01:00
x25	net/x25: Fix to not accept on connected socket	2023-02-09 11:28:13 +01:00
xdp	xsk: Fix unaligned descriptor validation	2023-05-11 23:03:21 +09:00
xfrm	xfrm: Reject optional tunnel/BEET mode templates in outbound policies	2023-05-24 17:32:43 +01:00
compat.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
devres.c
Kconfig
Kconfig.debug
Makefile
socket.c	net: annotate sk->sk_err write from do_recvmmsg()	2023-05-24 17:32:32 +01:00
sysctl_net.c