kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net
History
Alexey Kodanev e86c8c8cdf dccp: check sk for closed state in dccp_sendmsg() 
commit 67f93df79a upstream.

dccp_disconnect() sets 'dp->dccps_hc_tx_ccid' tx handler to NULL,
therefore if DCCP socket is disconnected and dccp_sendmsg() is
called after it, it will cause a NULL pointer dereference in
dccp_write_xmit().

This crash and the reproducer was reported by syzbot. Looks like
it is reproduced if commit 69c64866ce ("dccp: CVE-2017-8824:
use-after-free in DCCP code") is applied.

Reported-by: syzbot+f99ab3887ab65d70f816@syzkaller.appspotmail.com
Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-06-16 22:21:31 +01:00
..
9p net/9p: Switch to wait_event_killable() 2018-02-13 18:42:09 +00:00
802 neigh: use NEIGH_VAR_INIT in ndo_neigh_setup functions. 2014-01-16 11:31:58 -08:00
8021q 8021q: fix a memory leak for VLAN 0 device 2018-03-03 15:52:21 +00:00
appletalk appletalk: Fix socket referencing in skb 2014-07-08 19:39:43 -07:00
atm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2014-06-12 14:27:40 -07:00
ax25 Revert "ax25: add link layer header validation function" 2016-06-15 21:29:20 +01:00
batman-adv batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq 2018-03-03 15:51:43 +00:00
bluetooth Bluetooth: hidp_connection_add() unsafe use of l2cap_pi() 2018-06-16 22:21:29 +01:00
bridge netfilter: ebtables: fix erroneous reject of last rule 2018-06-16 22:21:30 +01:00
caif net: caif: fix misleading indentation 2017-11-11 13:33:52 +00:00
can can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once 2018-03-03 15:52:26 +00:00
ceph libceph: potential NULL dereference in ceph_msg_data_create() 2017-11-11 13:32:58 +00:00
core netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed 2018-01-01 20:52:04 +00:00
dcb net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-04-24 13:44:54 -04:00
dccp dccp: check sk for closed state in dccp_sendmsg() 2018-06-16 22:21:31 +01:00
decnet decnet: Do not build routes to devices without decnet private data. 2017-03-16 02:27:15 +00:00
dns_resolver dns_resolver: Null-terminate the right string 2014-07-20 22:33:32 -07:00
dsa net: dsa: Fix off-by-one in switch address parsing 2015-08-10 17:10:19 +01:00
ethernet net: eth_type_trans() should use skb_header_pointer() 2014-01-16 15:30:31 -08:00
hsr hsr: replace del_timer by del_timer_sync 2014-03-27 15:28:06 -04:00
ieee802154 ieee802154: Fix sockaddr_ieee802154 implicit padding information leak. 2015-07-15 10:00:19 +01:00
ipv4 net: igmp: fix source address check for IGMPv3 reports 2018-03-03 15:52:27 +00:00
ipv6 xfrm: Return error on unknown encap_type in init_state 2018-03-03 15:52:15 +00:00
ipx ipx: call ipxitf_put() in ioctl error path 2017-06-05 21:17:23 +01:00
irda irda: Fix lockdep annotations in hashbin_delete(). 2017-03-16 02:27:15 +00:00
iucv af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers 2017-10-12 15:27:52 +01:00
key af_key: fix buffer overread in parse_exthdrs() 2018-03-03 15:52:08 +00:00
l2tp l2tp: initialise PPP sessions before registering them 2018-02-13 18:42:11 +00:00
lapb net/lapb: re-send packets on timeout 2013-09-23 16:52:45 -04:00
llc net/llc: avoid BUG_ON() in skb_orphan() 2017-03-16 02:27:13 +00:00
mac80211 mac80211: don't compare TKIP TX MIC key in reinstall prevention 2017-11-26 13:50:39 +00:00
mac802154 mac802154: don't deliver packets to devices that are down 2014-06-11 12:10:19 -07:00
mpls net: gso: use feature flag argument in all protocol gso handlers 2015-08-27 14:27:14 +01:00
netfilter netfilter: xt_bpf: add overflow checks 2018-03-03 15:51:43 +00:00
netlabel netlabel: add address family checks to netlbl_{sock,req}_delattr() 2016-11-20 01:16:39 +00:00
netlink netlink: Add netns check on taps 2018-01-01 20:52:09 +00:00
netrom net: Fix use after free by removing length arg from sk_data_ready callbacks. 2014-04-11 16:15:36 -04:00
nfc NFC: fix device-allocation error return 2018-02-13 18:42:15 +00:00
openvswitch ovs: do not allocate memory from offline numa node 2015-10-28 10:33:20 +00:00
packet net/packet: fix a race in packet_bind() and packet_notifier() 2018-03-03 15:51:38 +00:00
phonet phonet: properly unshare skbs in phonet_rcv() 2016-01-28 10:51:50 +00:00
rds rds: Fix NULL pointer dereference in __rds_rdma_map 2018-03-03 15:52:35 +00:00
rfkill rfkill: fix rfkill_fop_read wait_event usage 2016-02-25 00:18:36 +00:00
rose rose: limit sk_filter trim to payload 2017-02-23 03:54:46 +00:00
rxrpc rxrpc: Fix several cases where a padded len isn't checked in ticket decode 2017-07-02 17:13:03 +01:00
sched net_sched: red: Avoid illegal values 2018-03-03 15:51:45 +00:00
sctp sctp: do not allow the v4 socket to bind a v4mapped v6 address 2018-03-03 15:52:24 +00:00
sunrpc kernel: make groups_sort calling a responsibility group_info allocators 2018-03-03 15:51:59 +00:00
tipc tipc: check minimum bearer MTU 2017-02-23 03:54:42 +00:00
unix net/unix: don't show information about sockets from other namespaces 2018-01-01 20:51:59 +00:00
vmw_vsock VSOCK: Detach QP check should filter out non matching QPs. 2017-11-26 13:50:40 +00:00
wimax wimax: remove dead code 2013-11-21 13:09:42 -05:00
wireless nl80211: Sanitize array index in parse_txq_params 2018-03-19 18:59:14 +00:00
x25 net: fix a kernel infoleak in x25 module 2016-06-15 21:29:34 +01:00
xfrm xfrm: Use __skb_queue_tail in xfrm_trans_queue 2018-03-03 15:52:13 +00:00
compat.c net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour 2015-03-24 10:48:46 +00:00
Kconfig Merge branch 'for-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup 2014-04-03 13:05:42 -07:00
Makefile net: move 6lowpan compression code to separate module 2014-01-15 15:36:38 -08:00
nonet.c llseek: automatically add .llseek fop 2010-10-15 15:53:27 +02:00
socket.c net: socket: fix recvmmsg not returning error from sock_error 2017-03-16 02:27:23 +00:00
sysctl_net.c net: Update the sysctl permissions handler to test effective uid/gid 2013-10-07 15:57:56 -04:00