Chuck Lever 653db17384 SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() ... commit 89a3c9f5b9 upstream. @subbuf is an output parameter of xdr_buf_subsegment(). A survey of call sites shows that @subbuf is always uninitialized before xdr_buf_segment() is invoked by callers. There are some execution paths through xdr_buf_subsegment() that do not set all of the fields in @subbuf, leaving some pointer fields containing garbage addresses. Subsequent processing of that buffer then results in a page fault. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-06-30 15:38:09 -04:00
..
6lowpan	6lowpan: Off by one handling ->nexthdr	2020-01-27 14:46:30 +01:00
9p	9p/virtio: Add cleanup path in p9_virtio_init	2019-07-31 07:28:39 +02:00
802
8021q	vlan: fix memory leak in vlan_dev_set_egress_priority	2020-01-12 12:12:09 +01:00
appletalk	appletalk: Set error code if register_snap_client failed	2019-12-17 20:38:59 +01:00
atm	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:25:34 +01:00
ax25	ax25: fix setsockopt(SO_BINDTODEVICE)	2020-06-03 08:17:31 +02:00
batman-adv	batman-adv: Fix refcnt leak in batadv_v_ogm_process	2020-05-20 08:16:59 +02:00
bluetooth	Bluetooth: Add SCO fallback for invalid LMP parameters error	2020-06-20 10:25:08 +02:00
bpf
bridge	net: bridge: enfore alignment for ethernet address	2020-06-30 15:37:58 -04:00
caif	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:25:34 +01:00
can	can: af_can: Fix error path of can_init()	2019-07-21 09:04:22 +02:00
ceph	libceph: ignore pool overlay and cache logic on redirects	2020-06-03 08:18:02 +02:00
core	net: Do not clear the sock TX queue in sk_set_socket()	2020-06-30 15:38:00 -04:00
dcb	net: dcb: For wild-card lookups, use priority -1, not 0	2018-09-19 22:43:43 +02:00
dccp	net: ipv6: add net argument to ip6_dst_lookup_flow	2020-05-20 08:17:02 +02:00
decnet	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2020-01-04 14:00:14 +01:00
dns_resolver	KEYS: Don't write out to userspace while holding key semaphore	2020-04-24 08:01:25 +02:00
dsa	net: dsa: Fix duplicate frames flooded by learning	2020-04-02 16:34:24 +02:00
ethernet	net: add annotations on hh->hh_len lockless accesses	2020-01-09 10:17:59 +01:00
hsr	hsr: check protocol version in hsr_newlink()	2020-04-24 08:00:52 +02:00
ieee802154	nl802154: add missing attribute validation for dev_type	2020-03-20 10:54:10 +01:00
ife
ipv4	net: Fix the arp error in some cases	2020-06-30 15:38:00 -04:00
ipv6	ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()	2020-06-30 15:38:00 -04:00
ipx
iucv	net/af_iucv: always register net_device notifier	2020-01-27 14:46:38 +01:00
kcm	kcm: switch order of device registration to fix a crash	2019-04-17 08:37:45 +02:00
key	xfrm: clean up xfrm protocol checks	2019-09-16 08:20:44 +02:00
l2tp	l2tp: add sk_family checks to l2tp_validate_socket	2020-06-11 09:22:59 +02:00
l3mdev
lapb	lapb: fixed leak of control-blocks.	2019-06-22 08:16:14 +02:00
llc	llc: fix sk_buff refcounting in llc_conn_state_process()	2020-01-27 14:46:49 +01:00
mac80211	mac80211: mesh: fix discovery timer re-arming issue / crash	2020-06-03 08:18:04 +02:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-09-09 19:55:52 +02:00
mpls	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2020-05-20 08:17:02 +02:00
ncsi
netfilter	netfilter: ipset: fix unaligned atomic access	2020-06-30 15:38:05 -04:00
netlabel	netlabel: cope with NULL catmap	2020-05-20 08:17:12 +02:00
netlink	netlink: Use netlink header as base to calculate bad attribute offset	2020-03-20 10:54:07 +01:00
netrom	net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node	2020-05-02 17:24:17 +02:00
nfc	nfc: add missing attribute validation for vendor subcommand	2020-03-20 10:54:12 +01:00
nsh	nsh: set mac len based on inner packet	2018-07-22 14:28:49 +02:00
openvswitch	openvswitch: support asymmetric conntrack	2019-12-21 10:47:34 +01:00
packet	net/packet: tpacket_rcv: avoid a producer race condition	2020-04-02 16:34:24 +02:00
phonet	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:25:34 +01:00
psample	net: psample: fix skb_over_panic	2019-12-05 15:38:15 +01:00
qrtr	net: qrtr: Fix passing invalid reference to qrtr_local_enqueue()	2020-06-03 08:17:38 +02:00
rds	net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'	2020-01-27 14:46:47 +01:00
rfkill	rfkill: Fix incorrect check to avoid NULL pointer dereference	2020-01-12 12:11:57 +01:00
rose	net/rose: fix unbound loop in rose_loopback_timer()	2019-05-02 09:40:34 +02:00
rxrpc	rxrpc: Fix handling of rwind from an ACK packet	2020-06-30 15:38:04 -04:00
sched	net: sched: export __netdev_watchdog_up()	2020-06-30 15:37:57 -04:00
sctp	sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket	2020-06-30 15:37:59 -04:00
smc	net/smc: check for valid ib_client_data	2020-03-20 10:54:20 +01:00
strparser	strparser: Remove early eaten to fix full tcp receive buffer stall	2018-07-22 14:28:47 +02:00
sunrpc	SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()	2020-06-30 15:38:09 -04:00
switchdev
tipc	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2020-05-20 08:17:02 +02:00
tls	net/tls: Fixed return value when tls_complete_pending_work() fails	2018-12-05 19:41:11 +01:00
unix	af_unix: add compat_ioctl support	2020-01-17 19:45:49 +01:00
vmw_vsock	vsock: fix timeout in vsock_accept()	2020-06-11 09:22:59 +02:00
wimax
wireless	cfg80211: check reg_rule for NULL in handle_channel_custom()	2020-03-20 10:54:24 +01:00
x25	net/x25: Fix x25_neigh refcnt leak when receiving frame	2020-05-02 17:24:17 +02:00
xfrm	xfrm: fix a NULL-ptr deref in xfrm_local_error	2020-06-03 08:18:06 +02:00
compat.c	sock: Make sock->sk_stamp thread-safe	2019-01-09 17:14:46 +01:00
Kconfig
Makefile
socket.c	compat_ioctl: handle SIOCOUTQNSD	2020-01-17 19:45:49 +01:00
sysctl_net.c