kernel.git/net/rxrpc, branch linux-4.1.y

rxrpc: check return value of skb_to_sgvec always

2018-05-23T01:36:30Z

[ Upstream commit 89a5ea99662505d2d61f2a3030a6896c2cb3cdb0 ] Signed-off-by: Jason A. Donenfeld Acked-by: David Howells Signed-off-by: David S. Miller Signed-off-by: Sasha Levin

rxrpc: Fix several cases where a padded len isn't checked in ticket decode

2017-07-31T17:37:48Z

[ Upstream commit 5f2f97656ada8d811d3c1bef503ced266fcd53a0 ] This fixes CVE-2017-7482. When a kerberos 5 ticket is being decoded so that it can be loaded into an rxrpc-type key, there are several places in which the length of a variable-length field is checked to make sure that it's not going to overrun the available data - but the data is padded to the nearest four-byte boundary and the code doesn't check for this extra. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. Fix this by making the various variable-length data checks use the padded length. Reported-by: 石磊 Signed-off-by: David Howells Reviewed-by: Marc Dionne Reviewed-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Sasha Levin

new helper: msg_data_left()

2015-04-11T19:53:35Z

convert open-coded instances Signed-off-by: Al Viro

Merge remote-tracking branch 'dh/afs' into for-davem

2015-04-11T19:51:09Z

RxRPC: Handle VERSION Rx protocol packets

2015-04-01T15:31:26Z

Handle VERSION Rx protocol packets. We should respond to a VERSION packet with a string indicating the Rx version. This is a maximum of 64 characters and is padded out to 65 chars with NUL bytes. Note that other AFS clients use the version request as a NAT keepalive so we need to handle it rather than returning an abort. The standard formulation seems to be: built --

for example: " OpenAFS 1.6.2 built 2013-05-07 " (note the three extra spaces) as obtained with: rxdebug grand.mit.edu -version from the openafs package. Signed-off-by: David Howells

RxRPC: Use iov_iter_count() in rxrpc_send_data() instead of the len argument

2015-04-01T14:49:26Z

Use iov_iter_count() in rxrpc_send_data() to get the remaining data length instead of using the len argument as the len argument is now redundant. Signed-off-by: David Howells

RxRPC: Don't call skb_add_data() if there's no data to copy

2015-04-01T14:48:00Z

Don't call skb_add_data() in rxrpc_send_data() if there's no data to copy and also skip the calculations associated with it in such a case. Signed-off-by: David Howells

RxRPC: Fix the conversion to iov_iter

2015-04-01T13:06:00Z

This commit: commit af2b040e470b470bfc881981db3c796072853eae Author: Al Viro Date: Thu Nov 27 21:44:24 2014 -0500 Subject: rxrpc: switch rxrpc_send_data() to iov_iter primitives incorrectly changes a do-while loop into a while loop in rxrpc_send_data(). Unfortunately, at least one pass through the loop is required - even if there is no data - so that the packet the closes the send phase can be sent if MSG_MORE is not set. Signed-off-by: David Howells

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-03-20T22:51:09Z

Conflicts: drivers/net/ethernet/emulex/benet/be_main.c net/core/sysctl_net_core.c net/ipv4/inet_diag.c The be_main.c conflict resolution was really tricky. The conflict hunks generated by GIT were very unhelpful, to say the least. It split functions in half and moved them around, when the real actual conflict only existed solely inside of one function, that being be_map_pci_bars(). So instead, to resolve this, I checked out be_main.c from the top of net-next, then I applied the be_main.c changes from 'net' since the last time I merged. And this worked beautifully. The inet_diag.c and sysctl_net_core.c conflicts were simple overlapping changes, and were easily to resolve. Signed-off-by: David S. Miller

rxrpc: bogus MSG_PEEK test in rxrpc_recvmsg()

2015-03-16T02:20:09Z

[I would really like an ACK on that one from dhowells; it appears to be quite straightforward, but...] MSG_PEEK isn't passed to ->recvmsg() via msg->msg_flags; as the matter of fact, neither the kernel users of rxrpc, nor the syscalls ever set that bit in there. It gets passed via flags; in fact, another such check in the same function is done correctly - as flags & MSG_PEEK. It had been that way (effectively disabled) for 8 years, though, so the patch needs beating up - that case had never been tested. If it is correct, it's -stable fodder. Signed-off-by: Al Viro Signed-off-by: David S. Miller