Eric Dumazet c16a98ed91 ipv6: tcp: fix panic in SYN processing ...

commit 72a3effaf633bc ([NET]: Size listen hash tables using backlog
hint) added a bug allowing inet6_synq_hash() to return an out of bound
array index, because of u16 overflow.

Bug can happen if system admins set net.core.somaxconn &
net.ipv4.tcp_max_syn_backlog sysctls to values greater than 65536

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2011-11-23 15:49:31 -05:00

..

netfilter

…

addrconf_core.c

…

addrconf.c

…

addrlabel.c

…

af_inet6.c

…

ah6.c

ah: Don't return NET_XMIT_DROP on input.

2011-11-12 18:13:32 -05:00

anycast.c

…

datagram.c

…

esp6.c

…

exthdrs_core.c

…

exthdrs.c

…

fib6_rules.c

…

icmp.c

…

inet6_connection_sock.c

ipv6: tcp: fix panic in SYN processing

2011-11-23 15:49:31 -05:00

inet6_hashtables.c

…

ip6_fib.c

…

ip6_flowlabel.c

…

ip6_input.c

…

ip6_output.c

…

ip6_tunnel.c

ip6_tunnel: copy parms.name after register_netdevice

2011-11-14 00:24:06 -05:00

ip6mr.c

…

ipcomp6.c

…

ipv6_sockglue.c

…

Kconfig

…

Makefile

…

mcast.c

…

mip6.c

…

ndisc.c

ipv6: fix a bug in ndisc_send_redirect

2011-11-23 03:51:54 -05:00

netfilter.c

…

proc.c

…

protocol.c

…

raw.c

…

reassembly.c

…

route.c

…

sit.c

…

syncookies.c

…

sysctl_net_ipv6.c

…

tcp_ipv6.c

…

tunnel6.c

…

udp_impl.h

…

udp.c

…

udplite.c

…

xfrm6_input.c

…

xfrm6_mode_beet.c

…

xfrm6_mode_ro.c

…

xfrm6_mode_transport.c

…

xfrm6_mode_tunnel.c

…

xfrm6_output.c

…

xfrm6_policy.c

…

xfrm6_state.c

…

xfrm6_tunnel.c

…