kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/net/core
History
Herbert Xu fae6f76ce1 net: Fix skb_set_peeked use-after-free bug 
[ Upstream commit a0a2a66024 ]

The commit 738ac1ebb9 ("net: Clone
skb before setting peeked flag") introduced a use-after-free bug
in skb_recv_datagram.  This is because skb_set_peeked may create
a new skb and free the existing one.  As it stands the caller will
continue to use the old freed skb.

This patch fixes it by making skb_set_peeked return the new skb
(or the old one if unchanged).

Fixes: 738ac1ebb9 ("net: Clone skb before setting peeked flag")
Reported-by: Brenden Blanco <bblanco@plumgrid.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Brenden Blanco <bblanco@plumgrid.com>
Reviewed-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2016-04-12 08:47:23 -04:00
..
datagram.c net: Fix skb_set_peeked use-after-free bug 2016-04-12 08:47:23 -04:00
dev.c net: call rcu_read_lock early in process_backlog 2015-09-28 18:58:22 -04:00
dev_addr_lists.c net: Add support for device specific address syncing 2014-06-02 10:40:54 -07:00
dev_ioctl.c dev_ioctl: remove dev_load() CAP_SYS_MODULE message 2014-09-05 12:04:40 -07:00
drop_monitor.c net: Replace get_cpu_var through this_cpu_ptr 2014-08-26 13:45:47 -04:00
dst.c net: possible use after free in dst_release 2016-02-15 15:42:43 -05:00
ethtool.c ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings 2015-11-13 13:17:15 -05:00
fib_rules.c fib_rules: Fix dump_rules() not to exit early 2015-10-28 03:52:10 -04:00
filter.c net: bpf: reject invalid shifts 2016-02-15 15:42:44 -05:00
flow.c flowcache: Fix kernel panic in flow_cache_flush_task 2015-03-14 15:37:09 -04:00
flow_dissector.c flow-dissector: Fix alignment issue in __skb_flow_get_ports 2014-10-10 15:33:47 -04:00
gen_estimator.c net: sched: make bstats per cpu and estimator RCU safe 2014-09-30 01:02:26 -04:00
gen_stats.c gen_stats.c: Duplicate xstats buffer for later use 2015-03-14 15:37:10 -04:00
iovec.c net: sendmsg: fix NULL pointer dereference 2014-07-29 12:20:22 -07:00
link_watch.c arch: Mass conversion of smp_mb__*() 2014-04-18 14:20:48 +02:00
Makefile dmaengine-3.17 2014-10-07 20:39:25 -04:00
neighbour.c net/neighbour: fix crash at dumping device-agnostic proxy entries 2015-12-14 12:19:27 -05:00
net-procfs.c rps: selective flow shedding during softnet overflow 2013-05-20 13:48:04 -07:00
net-sysfs.c net: do not name the pointer to struct net_device net 2014-07-24 23:33:55 -07:00
net-sysfs.h net: netdev_kobject_init: annotate with __init 2014-01-05 20:27:54 -05:00
net-traces.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00
net_namespace.c netns: remove one sparse warning 2014-09-09 20:10:45 -07:00
netclassid_cgroup.c cgroup: rename cgroup_subsys->base_cftypes to ->legacy_cftypes 2014-07-15 11:05:09 -04:00
netevent.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00
netpoll.c vlan: introduce *vlan_hwaccel_push_inside helpers 2015-04-27 16:48:34 -04:00
netprio_cgroup.c cgroup: rename cgroup_subsys->base_cftypes to ->legacy_cftypes 2014-07-15 11:05:09 -04:00
pktgen.c net: pktgen: fix race between pktgen_thread_worker() and kthread_stop() 2015-09-27 12:18:55 -04:00
ptp_classifier.c net: filter: split 'struct sk_filter' into socket and bpf parts 2014-08-02 15:03:58 -07:00
request_sock.c inet: reduce TLB pressure for listeners 2014-06-25 16:37:24 -07:00
rtnetlink.c rtnetlink: verify IFLA_VF_INFO attributes before passing them to driver 2015-10-27 09:32:53 -04:00
scm.c net, scm: fix PaX detected msg_controllen overflow in scm_detach_fds 2015-12-14 12:19:25 -05:00
secure_seq.c net: use ktime_get_ns() and ktime_get_real_ns() helpers 2014-08-22 19:57:23 -07:00
skbuff.c net: check both type and procotol for tcp sockets 2016-01-22 12:24:47 -05:00
sock.c net: check both type and procotol for tcp sockets 2016-01-22 12:24:47 -05:00
sock_diag.c net: filter: split 'struct sk_filter' into socket and bpf parts 2014-08-02 15:03:58 -07:00
stream.c net: replace macros net_random and net_srandom with direct calls to prandom 2014-01-14 15:15:25 -08:00
sysctl_net_core.c net: sysctl_net_core: check SNDBUF and RCVBUF for min length 2015-03-24 08:22:18 -04:00
timestamping.c net-timestamp: Make the clone operation stand-alone from phy timestamping 2014-09-05 17:43:45 -07:00
tso.c net: tso: fix unaligned access to crafted TCP header in helper API 2014-10-22 12:52:55 -04:00
utils.c net: optimise inet_proto_csum_replace4() 2014-09-26 16:14:17 -04:00