mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/net/tipc
History
David S. Miller 676d23690f net: Fix use after free by removing length arg from sk_data_ready callbacks. 
Several spots in the kernel perform a sequence like:

	skb_queue_tail(&sk->s_receive_queue, skb);
	sk->sk_data_ready(sk, skb->len);

But at the moment we place the SKB onto the socket receive queue it
can be consumed and freed up.  So this skb->len access is potentially
to freed up memory.

Furthermore, the skb->len can be modified by the consumer so it is
possible that the value isn't accurate.

And finally, no actual implementation of this callback actually uses
the length argument.  And since nobody actually cared about it's
value, lots of call sites pass arbitrary values in such as '0' and
even '1'.

So just remove the length argument from the callback, that way there
is no confusion whatsoever and all of these use-after-free cases get
fixed as a side effect.

Based upon a patch by Eric Dumazet and his suggestion to audit this
issue tree-wide.

Signed-off-by: David S. Miller <davem@davemloft.net>
 		2014-04-11 16:15:36 -04:00
..
Kconfig tipc: add InfiniBand media type 2013-04-17 14:18:33 -04:00
Makefile tipc: introduce new TIPC server infrastructure 2013-06-17 15:53:00 -07:00
addr.c tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
addr.h tipc: explicitly include core.h in addr.h 2014-02-13 17:49:13 -05:00
bcast.c tipc: make broadcast bearer store in bearer_list array 2014-03-27 13:08:37 -04:00
bcast.h tipc: align tipc function names with common naming practice in the network 2014-02-18 17:31:59 -05:00
bearer.c tipc: make discovery domain a bearer attribute 2014-03-28 14:46:29 -04:00
bearer.h tipc: fix neighbor detection problem after hw address change 2014-03-28 14:46:29 -04:00
config.c tipc: obsolete the remote management feature 2014-03-27 13:08:36 -04:00
config.h tipc: obsolete the remote management feature 2014-03-27 13:08:36 -04:00
core.c tipc: obsolete the remote management feature 2014-03-27 13:08:36 -04:00
core.h tipc: obsolete the remote management feature 2014-03-27 13:08:36 -04:00
discover.c tipc: make discovery domain a bearer attribute 2014-03-28 14:46:29 -04:00
discover.h tipc: make discovery domain a bearer attribute 2014-03-28 14:46:29 -04:00
eth_media.c tipc: eliminate code duplication in media layer 2013-12-11 00:17:43 -05:00
handler.c tipc: don't log disabled tasklet handler errors 2014-03-06 14:46:24 -05:00
ib_media.c tipc: eliminate code duplication in media layer 2013-12-11 00:17:43 -05:00
link.c tipc: tipc: convert node list and node hlist to RCU lists 2014-03-27 13:08:37 -04:00
link.h tipc: align tipc function names with common naming practice in the network 2014-02-18 17:31:59 -05:00
log.c tipc: remove print_buf and deprecated log buffer code 2012-07-13 19:34:43 -04:00
msg.c tipc: remove iovec length parameter from all sending functions 2013-10-18 13:20:42 -04:00
msg.h tipc: message reassembly using fragment chain 2013-11-07 18:30:11 -05:00
name_distr.c tipc: tipc: convert node list and node hlist to RCU lists 2014-03-27 13:08:37 -04:00
name_distr.h tipc: align tipc function names with common naming practice in the network 2014-02-18 17:31:59 -05:00
name_table.c tipc: fix memory leak during module removal 2014-03-06 14:46:24 -05:00
name_table.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
net.c tipc: fix regression bug where node events are not being generated 2014-04-03 16:03:57 -04:00
net.h tipc: change tipc_net_start routine return value type 2012-08-20 02:26:30 -07:00
netlink.c tipc: remove all enabled flags from all tipc components 2014-02-22 00:00:15 -05:00
node.c tipc: use node list lock to protect tipc_num_links variable 2014-03-27 13:08:38 -04:00
node.h tipc: tipc: convert node list and node hlist to RCU lists 2014-03-27 13:08:37 -04:00
node_subscr.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
node_subscr.h tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
port.c tipc: eliminate redundant lookups in registry 2014-03-12 15:53:49 -04:00
port.h tipc: eliminate redundant lookups in registry 2014-03-12 15:53:49 -04:00
ref.c tipc: eliminate redundant lookups in registry 2014-03-12 15:53:49 -04:00
ref.h tipc: eliminate redundant lookups in registry 2014-03-12 15:53:49 -04:00
server.c net: Fix use after free by removing length arg from sk_data_ready callbacks. 2014-04-11 16:15:36 -04:00
server.h tipc: remove all enabled flags from all tipc components 2014-02-22 00:00:15 -05:00
socket.c net: Fix use after free by removing length arg from sk_data_ready callbacks. 2014-04-11 16:15:36 -04:00
socket.h tipc: align usage of variable names and macros in socket 2014-03-12 15:53:49 -04:00
subscr.c tipc: fix spinlock recursion bug for failed subscriptions 2014-03-24 15:36:56 -04:00
subscr.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
sysctl.c tipc: change socket buffer overflow control to respect sk_rcvbuf 2013-06-17 15:53:00 -07:00