David S. Miller 676d23690f net: Fix use after free by removing length arg from sk_data_ready callbacks. ... Several spots in the kernel perform a sequence like: skb_queue_tail(&sk->s_receive_queue, skb); sk->sk_data_ready(sk, skb->len); But at the moment we place the SKB onto the socket receive queue it can be consumed and freed up. So this skb->len access is potentially to freed up memory. Furthermore, the skb->len can be modified by the consumer so it is possible that the value isn't accurate. And finally, no actual implementation of this callback actually uses the length argument. And since nobody actually cared about it's value, lots of call sites pass arbitrary values in such as '0' and even '1'. So just remove the length argument from the callback, that way there is no confusion whatsoever and all of these use-after-free cases get fixed as a side effect. Based upon a patch by Eric Dumazet and his suggestion to audit this issue tree-wide. Signed-off-by: David S. Miller <davem@davemloft.net>		2014-04-11 16:15:36 -04:00
..
9p	…
802	…
8021q	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-03-29 18:48:54 -04:00
appletalk	…
atm	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
ax25	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
batman-adv	batman-adv: Start new development cycle	2014-03-22 09:18:59 +01:00
bluetooth	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
bridge	bridge: Fix double free and memory leak around br_allowed_ingress	2014-04-11 15:12:47 -04:00
caif	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
can	…
ceph	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
core	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
dcb	…
dccp	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
decnet	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
dns_resolver	…
dsa	…
ethernet	…
hsr	hsr: replace del_timer by del_timer_sync	2014-03-27 15:28:06 -04:00
ieee802154	mac802154: make csma/cca parameters per-wpan	2014-04-01 16:25:51 -04:00
ipv4	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
ipv6	netfilter: Can't fail and free after table replacement	2014-04-05 17:46:22 +02:00
ipx	…
irda	…
iucv	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
key	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
l2tp	l2tp: take PMTU from tunnel UDP socket	2014-04-09 15:24:38 -04:00
lapb	…
llc	…
mac80211	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem	2014-03-21 14:02:04 -04:00
mac802154	mac802154: fix duplicate #include headers	2014-04-07 13:18:44 -04:00
mpls	…
netfilter	netfilter: nf_tables: fix wrong format in request_module()	2014-04-03 23:52:50 +02:00
netlabel	…
netlink	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
netrom	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
nfc	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
openvswitch	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-03-29 18:48:54 -04:00
packet	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
phonet	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
rds	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
rfkill	…
rose	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
rxrpc	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
sched	net-sysfs: expose number of carrier on/off changes	2014-03-31 16:24:52 -04:00
sctp	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
sunrpc	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
tipc	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
unix	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
vmw_vsock	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
wimax	…
wireless	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem	2014-03-21 14:02:04 -04:00
x25	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
xfrm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-03-25 20:29:20 -04:00
Kconfig	Merge branch 'for-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2014-04-03 13:05:42 -07:00
Makefile	…
compat.c	…
nonet.c	…
socket.c	net: ptp: move PTP classifier in its own file	2014-04-01 16:43:18 -04:00
sysctl_net.c	…