David S. Miller 676d23690f net: Fix use after free by removing length arg from sk_data_ready callbacks. ... Several spots in the kernel perform a sequence like: skb_queue_tail(&sk->s_receive_queue, skb); sk->sk_data_ready(sk, skb->len); But at the moment we place the SKB onto the socket receive queue it can be consumed and freed up. So this skb->len access is potentially to freed up memory. Furthermore, the skb->len can be modified by the consumer so it is possible that the value isn't accurate. And finally, no actual implementation of this callback actually uses the length argument. And since nobody actually cared about it's value, lots of call sites pass arbitrary values in such as '0' and even '1'. So just remove the length argument from the callback, that way there is no confusion whatsoever and all of these use-after-free cases get fixed as a side effect. Based upon a patch by Eric Dumazet and his suggestion to audit this issue tree-wide. Signed-off-by: David S. Miller <davem@davemloft.net>		2014-04-11 16:15:36 -04:00
..
9p	9p/trans_virtio.c: Fix broken zero-copy on vmalloc() buffers	2014-02-10 17:48:54 -08:00
802	neigh: use NEIGH_VAR_INIT in ndo_neigh_setup functions.	2014-01-16 11:31:58 -08:00
8021q	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-03-29 18:48:54 -04:00
appletalk	appletalk: fix checkpatch error with indent	2014-02-14 16:18:32 -05:00
atm	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
ax25	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
batman-adv	batman-adv: Start new development cycle	2014-03-22 09:18:59 +01:00
bluetooth	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
bridge	bridge: Fix double free and memory leak around br_allowed_ingress	2014-04-11 15:12:47 -04:00
caif	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
can	can: remove CAN FD compatibility for CAN 2.0 sockets	2014-03-03 14:29:52 +01:00
ceph	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
core	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
dcb	dcb: use __dev_get_by_name instead of dev_get_by_name to find interface	2014-01-14 18:50:46 -08:00
dccp	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
decnet	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
dns_resolver	net/*: Fix FSF address in file headers	2013-12-06 12:37:57 -05:00
dsa	dsa: Use ether_addr_copy	2014-01-21 18:13:05 -08:00
ethernet	net: eth_type_trans() should use skb_header_pointer()	2014-01-16 15:30:31 -08:00
hsr	hsr: replace del_timer by del_timer_sync	2014-03-27 15:28:06 -04:00
ieee802154	mac802154: make csma/cca parameters per-wpan	2014-04-01 16:25:51 -04:00
ipv4	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
ipv6	netfilter: Can't fail and free after table replacement	2014-04-05 17:46:22 +02:00
ipx	ipx: implement shutdown()	2014-02-12 19:26:32 -05:00
irda	net: add build-time checks for msg->msg_name size	2014-01-18 23:04:16 -08:00
iucv	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
key	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
l2tp	l2tp: take PMTU from tunnel UDP socket	2014-04-09 15:24:38 -04:00
lapb	net/lapb: re-send packets on timeout	2013-09-23 16:52:45 -04:00
llc	llc: remove noisy WARN from llc_mac_hdr_init	2014-01-28 18:01:32 -08:00
mac80211	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem	2014-03-21 14:02:04 -04:00
mac802154	mac802154: fix duplicate #include headers	2014-04-07 13:18:44 -04:00
mpls	ipip: add GSO/TSO support	2013-10-19 19:36:19 -04:00
netfilter	netfilter: nf_tables: fix wrong format in request_module()	2014-04-03 23:52:50 +02:00
netlabel	netlabel: Fix FSF address in file headers	2013-12-06 12:37:56 -05:00
netlink	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
netrom	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
nfc	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
openvswitch	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-03-29 18:48:54 -04:00
packet	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
phonet	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
rds	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
rfkill	net: rfkill: move poll work to power efficient workqueue	2014-02-04 21:58:16 +01:00
rose	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
rxrpc	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
sched	net-sysfs: expose number of carrier on/off changes	2014-03-31 16:24:52 -04:00
sctp	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
sunrpc	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
tipc	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
unix	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
vmw_vsock	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
wimax	wimax: remove dead code	2013-11-21 13:09:42 -05:00
wireless	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem	2014-03-21 14:02:04 -04:00
x25	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
xfrm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-03-25 20:29:20 -04:00
compat.c	net/compat: convert to COMPAT_SYSCALL_DEFINE with changing parameter types	2014-03-06 16:30:45 +01:00
Kconfig	Merge branch 'for-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2014-04-03 13:05:42 -07:00
Makefile	net: move 6lowpan compression code to separate module	2014-01-15 15:36:38 -08:00
nonet.c
socket.c	net: ptp: move PTP classifier in its own file	2014-04-01 16:43:18 -04:00
sysctl_net.c	net: Update the sysctl permissions handler to test effective uid/gid	2013-10-07 15:57:56 -04:00