kernel.git/net/decnet/af_decnet.c, branch linux-2.6.32.y

net: add validation for the socket syscall protocol argument

2016-01-29T21:12:42Z

commit 79462ad02e861803b3840cc782248c7359451cd9 upstream. éæ°¸å reported that one could simply crash the kernel as root by using a simple program: int socket_fd; struct sockaddr_in addr; addr.sin_port = 0; addr.sin_addr.s_addr = INADDR_ANY; addr.sin_family = 10; socket_fd = socket(10,3,0x40000000); connect(socket_fd , &addr,16); AF_INET, AF_INET6 sockets actually only support 8-bit protocol identifiers. inet_sock's skc_protocol field thus is sized accordingly, thus larger protocol identifiers simply cut off the higher bits and store a zero in the protocol fields. This could lead to e.g. NULL function pointer because as a result of the cut off inet_num is zero and we call down to inet_autobind, which is NULL for raw sockets. kernel: Call Trace: kernel: [] ? inet_autobind+0x2e/0x70 kernel: [] inet_dgram_connect+0x54/0x80 kernel: [] SYSC_connect+0xd9/0x110 kernel: [] ? ptrace_notify+0x5b/0x80 kernel: [] ? syscall_trace_enter_phase2+0x108/0x200 kernel: [] SyS_connect+0xe/0x10 kernel: [] tracesys_phase2+0x84/0x89 I found no particular commit which introduced this problem. CVE: CVE-2015-8543 Cc: Cong Wang Reported-by: éæ°¸å Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller [bwh: Backported to 2.6.32: open-code U8_MAX; adjust context] Signed-off-by: Ben Hutchings Signed-off-by: Willy Tarreau

DECnet: don't leak uninitialized stack byte

2010-12-09T21:27:03Z

commit 3c6f27bf33052ea6ba9d82369fb460726fb779c0 upstream. A single uninitialized padding byte is leaked to userspace. Signed-off-by: Dan Rosenberg Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

net: Make setsockopt() optlen be unsigned.

2009-09-30T23:12:20Z

This provides safety against negative optlen at the type level instead of depending upon (sometimes non-trivial) checks against this sprinkled all over the the place, in each and every implementation. Based upon work done by Arjan van de Ven and feedback from Linus Torvalds. Signed-off-by: David S. Miller

decnet: Use rcu_barrier() on module unload.

2009-06-26T20:51:27Z

The decnet module unloading as been disabled with a '#if 0' statement, because it have had issues. We add a rcu_barrier() anyhow for correctness. The maintainer (Chrissie Caulfield) will look into the unload issue when time permits. Acked-by: Paul E. McKenney Acked-by: Chrissie Caulfield Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller

net: correct off-by-one write allocations reports

2009-06-18T07:29:12Z

commit 2b85a34e911bf483c27cfdd124aeb1605145dc80 (net: No more expensive sock_hold()/sock_put() on each tx) changed initial sk_wmem_alloc value. We need to take into account this offset when reporting sk_wmem_alloc to user, in PROC_FS files or various ioctls (SIOCOUTQ/TIOCOUTQ) Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller

net: skb->dst accessors

2009-06-03T09:51:04Z

Define three accessors to get/set dst attached to a skb struct dst_entry *skb_dst(const struct sk_buff *skb) void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst) void skb_dst_drop(struct sk_buff *skb) This one should replace occurrences of : dst_release(skb->dst) skb->dst = NULL; Delete skb->dst field Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller

decnet: Use SKB queue and list helpers instead of doing it by-hand.

2009-05-28T23:43:52Z

Signed-off-by: David S. Miller

net: convert usage of packet_type to read_mostly

2009-03-10T12:22:43Z

Protocols that use packet_type can be __read_mostly section for better locality. Elminate any unnecessary initializations of NULL. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller

decnet: fix sparse warnings: symbol shadows an earlier one

2009-02-27T07:13:35Z

Impact: Remove redundant variable declarations, resp. rename inner scope variable. Fix this sparse warnings: net/decnet/af_decnet.c:1252:40: warning: symbol 'skb' shadows an earlier one net/decnet/af_decnet.c:1223:24: originally declared here net/decnet/af_decnet.c:1582:29: warning: symbol 'val' shadows an earlier one net/decnet/af_decnet.c:1527:22: originally declared here net/decnet/dn_dev.c:687:21: warning: symbol 'err' shadows an earlier one net/decnet/dn_dev.c:670:13: originally declared here net/decnet/sysctl_net_decnet.c:182:21: warning: symbol 'len' shadows an earlier one net/decnet/sysctl_net_decnet.c:173:16: originally declared here Signed-off-by: Hannes Eder Signed-off-by: David S. Miller

decnet: remove some pointless conditionals before kfree_skb()

2009-02-27T07:07:36Z

Remove some pointless conditionals before kfree_skb(). Signed-off-by: Wei Yongjun Signed-off-by: David S. Miller