kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/net
History
Herbert Xu fae6f76ce1 net: Fix skb_set_peeked use-after-free bug 
[ Upstream commit a0a2a66024 ]

The commit 738ac1ebb9 ("net: Clone
skb before setting peeked flag") introduced a use-after-free bug
in skb_recv_datagram.  This is because skb_set_peeked may create
a new skb and free the existing one.  As it stands the caller will
continue to use the old freed skb.

This patch fixes it by making skb_set_peeked return the new skb
(or the old one if unchanged).

Fixes: 738ac1ebb9 ("net: Clone skb before setting peeked flag")
Reported-by: Brenden Blanco <bblanco@plumgrid.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Brenden Blanco <bblanco@plumgrid.com>
Reviewed-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2016-04-12 08:47:23 -04:00
..
6lowpan 6lowpan: Allow 6LoWPAN to be modular 2014-08-07 11:44:18 -07:00
9p 9p: forgetting to cancel request on interrupted zero-copy RPC 2015-08-04 14:41:41 -04:00
802 net: set name_assign_type in alloc_netdev() 2014-07-15 16:12:48 -07:00
8021q net: better IFF_XMIT_DST_RELEASE support 2014-10-07 13:22:11 -04:00
appletalk Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-07-16 14:09:34 -07:00
atm net: better IFF_XMIT_DST_RELEASE support 2014-10-07 13:22:11 -04:00
ax25 net: add validation for the socket syscall protocol argument 2016-01-15 18:41:51 -05:00
batman-adv batman-adv: Fix potentially broken skb network header access 2015-10-27 22:14:13 -04:00
bluetooth bluetooth: Validate socket address length in sco_sock_bind(). 2016-01-15 18:41:51 -05:00
bridge bridge: Only call /sbin/bridge-stp for the initial network namespace 2016-02-15 15:42:43 -05:00
caif unix/caif: sk_socket can disappear when state is unlocked 2015-06-15 14:26:52 -04:00
can Revert "can: fix loss of CAN frames in raw_rcv" 2015-08-04 13:32:39 -04:00
ceph libceph: don't bail early from try_read() when skipping a message 2016-03-10 09:43:52 -05:00
core net: Fix skb_set_peeked use-after-free bug 2016-04-12 08:47:23 -04:00
dcb dcbnl : Disable software interrupts before taking dcb_lock 2014-11-16 14:50:52 -05:00
dccp ipv6: add complete rcu protection around np->opt 2015-12-14 12:19:26 -05:00
decnet net: add validation for the socket syscall protocol argument 2016-01-15 18:41:51 -05:00
dns_resolver Merge commit 'v3.16' into next 2014-10-01 00:44:04 +10:00
dsa net: dsa: slave: Fix autoneg for phys on switch MDIO bus 2014-11-06 15:06:28 -05:00
ethernet net: Add function for parsing the header length out of linear ethernet frames 2014-09-05 17:47:02 -07:00
hsr net/hsr: Remove left-over never-true conditional code. 2014-07-11 15:04:40 -07:00
ieee802154 Merge tag 'master-2014-10-02' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next 2014-10-05 21:34:39 -04:00
ipv4 xfrm: dst_entries_init() per-net dst_ops 2016-02-15 15:42:46 -05:00
ipv6 ipv6: drop frames with attached skb->sk in forwarding 2016-03-14 16:55:13 -04:00
ipx ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg 2014-11-20 22:57:03 -05:00
irda net: add validation for the socket syscall protocol argument 2016-01-15 18:41:51 -05:00
iucv iucv: Convert pr_warning to pr_warn 2014-09-10 12:40:10 -07:00
key af_key: remove unnecessary break after return 2014-07-15 16:27:00 -07:00
l2tp ipv6: add complete rcu protection around np->opt 2015-12-14 12:19:26 -05:00
lapb net/lapb: re-send packets on timeout 2013-09-23 16:52:45 -04:00
llc net_dma: simple removal 2014-09-28 07:05:16 -07:00
mac80211 mac80211: Fix Public Action frame RX in AP mode 2016-03-22 11:11:07 -04:00
mac802154 mac802154: fix typo IEEE802515 to IEEE802154 2016-02-09 22:57:31 -05:00
mpls mpls: Allow mpls_gso to be built as module 2014-10-31 15:47:21 -04:00
netfilter ipvs: fix crash with sync protocol v0 and FTP 2015-10-27 22:13:54 -04:00
netlabel cipso: don't use IPCB() to locate the CIPSO IP option 2015-03-06 14:52:59 -08:00
netlink netlink, mmap: transform mmap skb into full skb on taps 2015-10-27 09:33:01 -04:00
netrom netrom: use linux/uaccess.h 2014-10-17 23:52:54 -04:00
nfc NFC: nci: Add support for proprietary RF Protocols 2014-09-24 02:02:24 +02:00
openvswitch openvswitch: Zero flows on allocation. 2015-10-27 09:33:03 -04:00
packet packet: fix tpacket_snd max frame len 2015-12-14 12:19:23 -05:00
phonet phonet: properly unshare skbs in phonet_rcv() 2016-02-15 15:42:44 -05:00
rds RDS: verify the underlying transport exists before creating a connection 2016-01-22 12:24:42 -05:00
rfkill rfkill: fix rfkill_fop_read wait_event usage 2016-02-15 15:42:34 -05:00
rose NET: ROSE: Don't dereference NULL neighbour pointer. 2015-07-05 10:12:48 -04:00
rxrpc rxrpc: bogus MSG_PEEK test in rxrpc_recvmsg() 2015-03-24 08:22:20 -04:00
sched net: sched: fix missing free per cpu on qstats 2016-02-15 15:42:43 -05:00
sctp net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory 2016-02-15 15:42:44 -05:00
sunrpc sunrpc/cache: fix off-by-one in qword_get() 2016-03-08 01:14:06 -05:00
tipc net/tipc: initialize security state for new connection socket 2015-09-27 12:18:54 -04:00
unix unix: properly account for FDs passed over unix sockets 2016-02-15 15:42:43 -05:00
vmw_vsock vsock: Make transport the proto owner 2014-05-05 13:13:50 -04:00
wimax wimax: convert printk to pr_foo() 2014-10-07 20:28:44 -04:00
wireless cfg80211/wext: fix message ordering 2016-03-20 22:13:50 -04:00
x25 net: Fix use after free by removing length arg from sk_data_ready callbacks. 2014-04-11 16:15:36 -04:00
xfrm xfrm: dst_entries_init() per-net dst_ops 2016-02-15 15:42:46 -05:00
compat.c net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour 2015-03-24 08:22:21 -04:00
Kconfig bpf: split eBPF out of NET 2014-10-27 19:09:59 -04:00
Makefile 6lowpan: introduce new net/6lowpan directory 2014-07-12 01:53:30 +02:00
nonet.c llseek: automatically add .llseek fop 2010-10-15 15:53:27 +02:00
socket.c net: socket: Fix the wrong returns for recvmsg and sendmsg 2015-07-03 12:34:30 -04:00
sysctl_net.c net: Update the sysctl permissions handler to test effective uid/gid 2013-10-07 15:57:56 -04:00