Francesco Ruggeri e0e6b0d7e0 netfilter: compat: initialize all fields in xt_init ... [ Upstream commit 8d29d16d21 ] If a non zero value happens to be in xt[NFPROTO_BRIDGE].cur at init time, the following panic can be caused by running % ebtables -t broute -F BROUTING from a 32-bit user level on a 64-bit kernel. This patch replaces kmalloc_array with kcalloc when allocating xt. [ 474.680846] BUG: unable to handle kernel paging request at 0000000009600920 [ 474.687869] PGD 2037006067 P4D 2037006067 PUD 2038938067 PMD 0 [ 474.693838] Oops: 0000 [#1] SMP [ 474.697055] CPU: 9 PID: 4662 Comm: ebtables Kdump: loaded Not tainted 4.19.17-11302235.AroraKernelnext.fc18.x86_64 #1 [ 474.707721] Hardware name: Supermicro X9DRT/X9DRT, BIOS 3.0 06/28/2013 [ 474.714313] RIP: 0010:xt_compat_calc_jump+0x2f/0x63 [x_tables] [ 474.720201] Code: 40 0f b6 ff 55 31 c0 48 6b ff 70 48 03 3d dc 45 00 00 48 89 e5 8b 4f 6c 4c 8b 47 60 ff c9 39 c8 7f 2f 8d 14 08 d1 fa 48 63 fa <41> 39 34 f8 4c 8d 0c fd 00 00 00 00 73 05 8d 42 01 eb e1 76 05 8d [ 474.739023] RSP: 0018:ffffc9000943fc58 EFLAGS: 00010207 [ 474.744296] RAX: 0000000000000000 RBX: ffffc90006465000 RCX: 0000000002580249 [ 474.751485] RDX: 00000000012c0124 RSI: fffffffff7be17e9 RDI: 00000000012c0124 [ 474.758670] RBP: ffffc9000943fc58 R08: 0000000000000000 R09: ffffffff8117cf8f [ 474.765855] R10: ffffc90006477000 R11: 0000000000000000 R12: 0000000000000001 [ 474.773048] R13: 0000000000000000 R14: ffffc9000943fcb8 R15: ffffc9000943fcb8 [ 474.780234] FS: 0000000000000000(0000) GS:ffff88a03f840000(0063) knlGS:00000000f7ac7700 [ 474.788612] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 474.794632] CR2: 0000000009600920 CR3: 0000002037422006 CR4: 00000000000606e0 [ 474.802052] Call Trace: [ 474.804789] compat_do_replace+0x1fb/0x2a3 [ebtables] [ 474.810105] compat_do_ebt_set_ctl+0x69/0xe6 [ebtables] [ 474.815605] ? try_module_get+0x37/0x42 [ 474.819716] compat_nf_setsockopt+0x4f/0x6d [ 474.824172] compat_ip_setsockopt+0x7e/0x8c [ 474.828641] compat_raw_setsockopt+0x16/0x3a [ 474.833220] compat_sock_common_setsockopt+0x1d/0x24 [ 474.838458] __compat_sys_setsockopt+0x17e/0x1b1 [ 474.843343] ? __check_object_size+0x76/0x19a [ 474.847960] __ia32_compat_sys_socketcall+0x1cb/0x25b [ 474.853276] do_fast_syscall_32+0xaf/0xf6 [ 474.857548] entry_SYSENTER_compat+0x6b/0x7a Signed-off-by: Francesco Ruggeri <fruggeri@arista.com> Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-03-23 20:09:45 +01:00
..
6lowpan	6lowpan: iphc: reset mac_header after decompress to fix panic	2018-07-06 12:32:12 +02:00
9p	9p/net: fix memory leak in p9_client_create	2019-03-23 20:09:38 +01:00
802
8021q	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
appletalk	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
atm	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
ax25	ax25: fix possible use-after-free	2019-02-23 09:07:27 +01:00
batman-adv	batman-adv: release station info tidstats	2019-03-13 14:02:34 -07:00
bluetooth	Bluetooth: Fix locking in bt_accept_enqueue() for BH context	2019-03-10 07:17:21 +01:00
bpf	bpf/test_run: support cgroup local storage	2018-08-03 00:47:32 +02:00
bpfilter	net: bpfilter: use get_pid_task instead of pid_task	2018-10-17 22:03:40 -07:00
bridge	netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present	2019-03-13 14:02:29 -07:00
caif	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
can	can: bcm: check timer values before ktime conversion	2019-01-31 08:14:39 +01:00
ceph	libceph: handle an empty authorize reply	2019-02-27 10:08:50 +01:00
core	gro_cells: make sure device is up in gro_cells_receive()	2019-03-19 13:12:38 +01:00
dcb	net: dcb: Add priority-to-DSCP map getters	2018-07-27 13:17:50 -07:00
dccp	dccp: fool proof ccid_hc_[rt]x_parse_options()	2019-02-12 19:47:21 +01:00
decnet	decnet: fix using plain integer as NULL warning	2018-08-09 14:11:24 -07:00
dns_resolver	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
dsa	net: dsa: slave: Don't propagate flag changes on down slave interfaces	2019-02-12 19:47:22 +01:00
ethernet	net: Convert GRO SKB handling to list_head.	2018-06-26 11:33:04 +09:00
hsr	net/hsr: fix possible crash in add_timer()	2019-03-19 13:12:38 +01:00
ieee802154	ieee802154: lowpan_header_create check must check daddr	2019-01-09 17:38:31 +01:00
ife
ipv4	tcp: handle inet_csk_reqsk_queue_add() failures	2019-03-19 13:12:39 +01:00
ipv6	ipv6: route: enforce RCU protection in ip6_route_check_nh_onlink()	2019-03-19 13:12:40 +01:00
iucv	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
kcm	Revert "kcm: remove any offset before parsing messages"	2018-09-17 18:43:42 -07:00
key	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2018-07-27 09:33:37 -07:00
l2tp	l2tp: fix infoleak in l2tp_ip6_recvmsg()	2019-03-19 13:12:38 +01:00
l3mdev
lapb
llc	llc: do not use sk_eat_skb()	2018-12-01 09:37:27 +01:00
mac80211	mac80211: Fix Tx aggregation session tear down with ITXQs	2019-03-23 20:09:45 +01:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-08-06 11:21:37 +02:00
mpls	mpls: Return error for RTA_GATEWAY attribute	2019-03-10 07:17:19 +01:00
ncsi	net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler	2018-08-22 21:39:08 -07:00
netfilter	netfilter: compat: initialize all fields in xt_init	2019-03-23 20:09:45 +01:00
netlabel	netlabel: fix out-of-bounds memory accesses	2019-03-10 07:17:18 +01:00
netlink	Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net	2018-08-05 13:04:31 -07:00
netrom	netrom: switch to sock timer API	2019-02-06 17:30:07 +01:00
nfc	net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails	2019-03-10 07:17:18 +01:00
nsh	nsh: set mac len based on inner packet	2018-07-12 16:55:29 -07:00
openvswitch	openvswitch: Avoid OOB read when parsing flow nlattrs	2019-01-31 08:14:32 +01:00
packet	net/packet: fix 4gb buffer limit due to overflow check	2019-02-27 10:08:58 +01:00
phonet	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
psample
qrtr	net: qrtr: Reset the node and port ID of broadcast messages	2018-07-05 20:20:03 +09:00
rds	rds: fix refcount bug in rds_sock_addref	2019-02-12 19:47:22 +01:00
rfkill	Here are quite a large number of fixes, notably:	2018-09-03 22:12:02 -07:00
rose	net/rose: fix NULL ax25_cb kernel panic	2019-02-06 17:30:07 +01:00
rxrpc	rxrpc: Fix client call queueing, waiting for channel	2019-03-19 13:12:39 +01:00
sched	net: sched: flower: insert new filter to idr after setting its mask	2019-03-19 13:12:41 +01:00
sctp	sctp: remove sched init from sctp_stream_init	2019-03-19 13:12:39 +01:00
smc	net/smc: fix smc_poll in SMC_INIT state	2019-03-19 13:12:41 +01:00
strparser	strparser: remove redundant variable 'rd_desc'	2018-08-01 10:00:06 -07:00
sunrpc	xprtrdma: Double free in rpcrdma_sendctxs_create()	2019-02-27 10:08:53 +01:00
switchdev
tipc	tipc: fix race condition causing hung sendto	2019-03-10 07:17:18 +01:00
tls	net/tls: Init routines in create_ctx	2019-01-13 09:51:00 +01:00
unix	missing barriers in some of unix_sock ->addr and ->path accesses	2019-03-19 13:12:41 +01:00
vmw_vsock	vsock/virtio: reset connected sockets on device removal	2019-03-13 14:02:36 -07:00
wimax	wimax: remove blank lines at EOF	2018-07-24 14:10:42 -07:00
wireless	cfg80211: extend range deviation for DMG	2019-03-05 17:58:52 +01:00
x25	net/x25: fix a race in x25_bind()	2019-03-19 13:12:40 +01:00
xdp	xsk: do not call synchronize_net() under RCU read lock	2018-10-11 10:19:01 +02:00
xfrm	xfrm: refine validation of template and selector families	2019-02-15 08:10:13 +01:00
compat.c	sock: Make sock->sk_stamp thread-safe	2019-01-09 17:38:33 +01:00
Kconfig	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
Makefile	bpfilter: check compiler capability in Kconfig	2018-06-28 13:36:39 +09:00
socket.c	net: socket: set sock->sk to NULL after calling proto_ops::release()	2019-03-10 07:17:18 +01:00
sysctl_net.c