Patch "net: __skb_flow_dissect() must cap its return value" has been added to the 4.8-stable tree

This is a note to let you know that I've just added the patch titled

net: __skb_flow_dissect() must cap its return value

to the 4.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-__skb_flow_dissect-must-cap-its-return-value.patch
and it can be found in the queue-4.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Eric Dumazet <[email protected]>
Date: Wed, 9 Nov 2016 16:04:46 -0800
Subject: net: __skb_flow_dissect() must cap its return value

From: Eric Dumazet <[email protected]>

[ Upstream commit 34fad54c2537f7c99d07375e50cb30aa3c23bd83 ]

After Tom patch, thoff field could point past the end of the buffer, this could fool some callers.

If an skb was provided, skb->len should be the upper limit. If not, hlen is supposed to be the upper limit.

---
 net/core/flow_dissector.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

@@ -118,7 +118,7 @@ bool __skb_flow_dissect(const struct sk_
 	struct flow_dissector_key_tags *key_tags;
 	struct flow_dissector_key_keyid *key_keyid;
 	u8 ip_proto = 0;
-	bool ret = false;
+	bool ret;
 
 	if (!data) {
 		data = skb->data;

@@ -481,12 +481,17 @@ ip_proto_again:
 out_good:
 	ret = true;
 
-out_bad:
+	key_control->thoff = (u16)nhoff;
+out:
 	key_basic->n_proto = proto;
 	key_basic->ip_proto = ip_proto;
-	key_control->thoff = (u16)nhoff;
 
 	return ret;
+
+out_bad:
+	ret = false;
+	key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);
+	goto out;
 }
 EXPORT_SYMBOL(__skb_flow_dissect);
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.8/net-__skb_flow_dissect-must-cap-its-return-value.patch queue-4.8/tcp-take-care-of-truncations-done-by-sk_filter.patch queue-4.8/net-clear-sk_err_soft-in-sk_clone_lock.patch queue-4.8/dccp-do-not-release-listeners-too-soon.patch queue-4.8/net-mangle-zero-checksum-in-skb_checksum_help.patch queue-4.8/tcp-fix-return-value-for-partial-writes.patch queue-4.8/ipv6-dccp-fix-out-of-bound-access-in-dccp_v6_err.patch queue-4.8/ipv6-dccp-add-missing-bind_conflict-to-dccp_ipv6_mapped.patch queue-4.8/tcp-fix-potential-memory-corruption.patch queue-4.8/dccp-do-not-send-reset-to-already-closed-sockets.patch queue-4.8/dccp-fix-out-of-bound-access-in-dccp_v4_err.patch queue-4.8/sock-fix-sendmmsg-for-partial-sendmsg.patch