Johannes Berg 68dd02d19c dev_ioctl: copy only the smaller struct iwreq for wext ... Unfortunately, struct iwreq isn't a proper subset of struct ifreq, but is still handled by the same code path. Robert reported that then applications may (randomly) fault if the struct iwreq they pass happens to land within 8 bytes of the end of a mapping (the struct is only 32 bytes, vs. struct ifreq's 40 bytes). To fix this, pull out the code handling wireless extension ioctls and copy only the smaller structure in this case. This bug goes back a long time, I tracked that it was introduced into mainline in 2.1.15, over 20 years ago! This fixes https://bugzilla.kernel.org/show_bug.cgi?id=195869 Reported-by: Robert O'Callahan <robert@ocallahan.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com>		2017-06-14 13:52:44 +02:00
..
9p
bluetooth	Bluetooth: L2CAP: Fix L2CAP_CR_SCID_IN_USE value	2017-04-12 22:02:37 +02:00
caif
irda	scripts/spelling.txt: add "overide" pattern and fix typo instances	2017-03-09 17:01:09 -08:00
iucv
netfilter	netfilter: nf_tables: revisit chain/object refcounting from elements	2017-05-15 12:51:41 +02:00
netns	can: network namespace support for CAN gateway	2017-04-25 09:04:30 +02:00
nfc	NFC: Add nfc_dbg() macro	2017-04-05 10:15:20 +02:00
phonet
sctp	sctp: process duplicated strreset out and addstrm out requests correctly	2017-04-18 13:39:50 -04:00
tc_act	net/sched: act_csum: Add accessors for offloading drivers	2017-05-23 16:23:31 +03:00
6lowpan.h	6lowpan: Fix IID format for Bluetooth	2017-04-12 22:02:36 +02:00
act_api.h	net sched actions: Add support for user cookies	2017-01-25 12:37:04 -05:00
addrconf.h	ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf	2017-05-08 17:31:24 -04:00
af_ieee802154.h
af_rxrpc.h	rxrpc: Note a successfully aborted kernel operation	2017-04-06 10:11:59 +01:00
af_unix.h
af_vsock.h	VSOCK: Add vsockmon tap functions	2017-04-24 12:35:56 -04:00
ah.h
arp.h	net: add confirm_neigh method to dst_ops	2017-02-07 13:07:46 -05:00
atmclip.h
ax25.h
ax88796.h
bond_3ad.h
bond_alb.h
bond_options.h
bonding.h	bonding: fix wq initialization for links created via netlink	2017-04-21 15:28:37 -04:00
busy_poll.h	net: Commonize busy polling code to focus on napi_id instead of socket	2017-03-24 20:49:31 -07:00
calipso.h
cfg80211-wext.h
cfg80211.h	cfg80211: fix multi scheduled scan kernel-doc	2017-05-08 13:09:38 +02:00
cfg802154.h
checksum.h	csum: eliminate sparse warning in remcsum_unadjust()	2017-01-20 12:12:13 -05:00
cipso_ipv4.h	netlabel: out of bound access in cipso_v4_validate()	2017-02-04 19:44:22 -05:00
cls_cgroup.h
codel_impl.h
codel_qdisc.h
codel.h
compat.h
datalink.h
dcbevent.h
dcbnl.h
devlink.h	net/devlink: Add E-Switch encapsulation control	2017-04-22 20:26:37 +03:00
dn_dev.h
dn_fib.h
dn_neigh.h
dn_nsp.h
dn_route.h
dn.h
dsa.h	net: dsa: add support for the SMSC-LAN9303 tagging format	2017-04-20 13:48:54 -04:00
dsfield.h
dst_cache.h
dst_metadata.h
dst_ops.h	net: add confirm_neigh method to dst_ops	2017-02-07 13:07:46 -05:00
dst.h	ipv4: add reference counting to metrics	2017-05-26 14:57:07 -04:00
esp.h	esp6: Reorganize esp_output	2017-04-14 10:06:42 +02:00
ethoc.h
fib_rules.h	net: rtnetlink: plumb extended ack to doit function	2017-04-17 15:35:38 -04:00
firewire.h
flow_dissector.h	flow_dissector: add mpls support (v2)	2017-04-24 14:30:46 -04:00
flow.h	flowcache: make flow_key_size() return "unsigned int"	2017-04-03 19:04:48 -07:00
flowcache.h	flowcache: more "unsigned int"	2017-04-03 19:04:48 -07:00
fou.h
fq_impl.h
fq.h
garp.h
gen_stats.h
genetlink.h	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
geneve.h
gre.h
gro_cells.h	gro_cells: move to net/core/gro_cells.c	2017-02-08 14:38:18 -05:00
gtp.h
gue.h
hwbm.h
icmp.h
ieee80211_radiotap.h	wireless: radiotap: rewrite the radiotap header file	2017-01-25 16:00:33 +01:00
ieee802154_netdev.h
if_inet6.h	net/ipv6: allow sysctl to change link-local address generation mode	2017-01-27 10:25:34 -05:00
ife.h	net: Introduce ife encapsulation module	2017-02-03 15:16:45 -05:00
ila.h
inet6_connection_sock.h
inet6_hashtables.h
inet_common.h	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
inet_connection_sock.h	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
inet_ecn.h
inet_frag.h	net: remove bh disabling around percpu_counter accesses	2017-01-20 11:27:22 -05:00
inet_hashtables.h
inet_sock.h	net/tcp-fastopen: Add new API support	2017-01-25 14:04:38 -05:00
inet_timewait_sock.h
inetpeer.h
ip6_checksum.h
ip6_fib.h	net: ipv6: Allow shorthand delete of all nexthops in multipath route	2017-02-04 19:58:14 -05:00
ip6_route.h	ipv6: initialize route null entry in addrconf_init()	2017-05-04 12:51:24 -04:00
ip6_tunnel.h	ip6_tunnel: Allow policy-based routing through tunnels	2017-04-21 13:21:30 -04:00
ip_fib.h	ipv4: add reference counting to metrics	2017-05-26 14:57:07 -04:00
ip_tunnels.h	ip_tunnel: Allow policy-based routing through tunnels	2017-04-21 13:21:31 -04:00
ip_vs.h	ipvs: remove unused function ip_vs_set_state_timeout	2017-04-28 12:00:10 +02:00
ip.h	net: ipv4: Refine the ipv4_default_advmss	2017-04-13 13:19:48 -04:00
ipcomp.h
ipconfig.h
ipv6.h	net: ping: do not abuse udp_poll()	2017-06-04 22:56:55 -04:00
ipx.h
iw_handler.h
kcm.h
l3mdev.h
lapb.h
lib80211.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
llc.h
lwtunnel.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-02-11 02:31:11 -05:00
mac80211.h	mac80211: properly remove RX_ENC_FLAG_40MHZ	2017-05-08 11:11:56 +02:00
mac802154.h
mip6.h
mld.h
mpls_iptunnel.h	net: mpls: Increase max number of labels for lwt encap	2017-04-01 20:21:44 -07:00
mpls.h
mrp.h
ncsi.h
ndisc.h	ipv6: add support for NETDEV_RESEND_IGMP event	2017-03-28 22:02:21 -07:00
neighbour.h	net: neigh: make ->hh_len 32-bit	2017-04-12 13:59:21 -04:00
net_namespace.h	can: initial support for network namespaces	2017-04-04 17:35:58 +02:00
net_ratelimit.h
netevent.h
netlabel.h
netlink.h	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
netprio_cgroup.h
netrom.h
nexthop.h
nl802154.h
p8022.h
ping.h
pkt_cls.h	net/sched: Reflect HW offload status	2017-02-17 12:08:05 -05:00
pkt_sched.h	net: sched: make default fifo qdiscs appear in the dump	2017-03-12 22:53:02 -07:00
pptp.h
protocol.h	net: Add sysctl to toggle early demux for tcp and udp	2017-03-24 13:17:07 -07:00
psample.h	net: Introduce psample, a new genetlink channel for packet sampling	2017-01-24 13:44:28 -05:00
psnap.h
raw.h
rawv6.h
red.h
regulatory.h
request_sock.h
rose.h
route.h	Revert "ipv4: restore rt->fi for reference counting"	2017-05-08 22:35:32 -04:00
rtnetlink.h	net: rtnetlink: plumb extended ack to doit function	2017-04-17 15:35:38 -04:00
sch_generic.h	net_sched: move the empty tp check from ->destroy() to ->delete()	2017-04-21 13:58:15 -04:00
scm.h	sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>	2017-03-02 08:42:31 +01:00
secure_seq.h	tcp: randomize timestamps on syncookies	2017-05-05 12:00:11 -04:00
seg6_hmac.h
seg6.h
slhc_vj.h
smc.h
snmp.h
sock_reuseport.h
sock.h	Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-05-10 10:30:46 -07:00
Space.h
stp.h
strparser.h
switchdev.h	switchdev: bridge: Offload mc router ports	2017-02-10 11:46:39 -05:00
tcp_states.h
tcp.h	net: Update TCP congestion control documentation	2017-06-05 10:53:24 -04:00
timewait_sock.h
transp_v6.h
tso.h
udp_tunnel.h
udp.h	net: Add sysctl to toggle early demux for tcp and udp	2017-03-24 13:17:07 -07:00
udplite.h
vsock_addr.h
vxlan.h
wext.h	dev_ioctl: copy only the smaller struct iwreq for wext	2017-06-14 13:52:44 +02:00
wimax.h
x25.h	net: x25: fix one potential use-after-free issue	2017-05-18 10:05:40 -04:00
x25device.h
xfrm.h	xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY	2017-05-04 07:30:59 +02:00