David S. Miller 676d23690f net: Fix use after free by removing length arg from sk_data_ready callbacks. ... Several spots in the kernel perform a sequence like: skb_queue_tail(&sk->s_receive_queue, skb); sk->sk_data_ready(sk, skb->len); But at the moment we place the SKB onto the socket receive queue it can be consumed and freed up. So this skb->len access is potentially to freed up memory. Furthermore, the skb->len can be modified by the consumer so it is possible that the value isn't accurate. And finally, no actual implementation of this callback actually uses the length argument. And since nobody actually cared about it's value, lots of call sites pass arbitrary values in such as '0' and even '1'. So just remove the length argument from the callback, that way there is no confusion whatsoever and all of these use-after-free cases get fixed as a side effect. Based upon a patch by Eric Dumazet and his suggestion to audit this issue tree-wide. Signed-off-by: David S. Miller <davem@davemloft.net>		2014-04-11 16:15:36 -04:00
..
Kconfig	net/rds: remove depends on CONFIG_EXPERIMENTAL	2013-01-11 11:40:02 -08:00
Makefile	Net: rds: Makefile: Remove deprecated items	2010-11-22 08:16:15 -08:00
af_rds.c	rds: Make rds_sock_lock BH rather than IRQ safe.	2012-01-24 17:03:44 -05:00
bind.c	net: replace macros net_random and net_srandom with direct calls to prandom	2014-01-14 15:15:25 -08:00
cong.c	net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules	2011-10-31 19:30:30 -04:00
connection.c	inet: convert inet_ehash_secret and ipv6_hash_secret to net_get_random_once	2013-10-19 19:45:35 -04:00
ib.c	rds: prevent dereference of a NULL device	2013-12-27 12:33:58 -05:00
ib.h	net: rds: use this_cpu_* per-cpu helper	2012-11-19 18:59:44 -05:00
ib_cm.c	IB/rds: suppress incompatible protocol when version is known	2012-12-26 15:17:37 -08:00
ib_rdma.c	net, rds, Replace xlist in net/rds/xlist.h with llist	2011-09-15 15:36:32 -04:00
ib_recv.c	net: rds: fix per-cpu helper usage	2014-01-17 17:52:22 -08:00
ib_ring.c	RDS/IW+IB: Set recv ring low water mark to 1/2 full.	2009-04-09 17:21:14 -07:00
ib_send.c	rds: prevent BUG_ON triggered on congestion update to loopback	2013-12-03 11:54:18 -05:00
ib_stats.c	RDS: Move atomic stats from general to ib-specific area	2010-09-08 18:12:20 -07:00
ib_sysctl.c	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
info.c	rds: remove the second argument of k[un]map_atomic()	2012-03-20 21:48:28 +08:00
info.h	…
iw.c	rds: prevent dereference of a NULL device in rds_iw_laddr_check	2014-03-31 16:25:52 -04:00
iw.h	net: remove interrupt.h inclusion from netdevice.h	2011-06-06 22:55:11 -07:00
iw_cm.c	RDS: use gfp flags from caller in conn_alloc()	2012-03-22 19:29:58 -04:00
iw_rdma.c	RDS: Remove some unused iWARP code	2012-01-12 20:05:28 -08:00
iw_recv.c	Merge branch 'kmap_atomic' of git://github.com/congwang/linux	2012-03-21 09:40:26 -07:00
iw_ring.c	RDS/IW+IB: Set recv ring low water mark to 1/2 full.	2009-04-09 17:21:14 -07:00
iw_send.c	net/rds: use prink_ratelimited() instead of printk_ratelimit()	2011-06-17 00:03:03 -04:00
iw_stats.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2009-09-15 09:39:44 -07:00
iw_sysctl.c	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
loop.c	RDS: use gfp flags from caller in conn_alloc()	2012-03-22 19:29:58 -04:00
loop.h	…
message.c	rds: simplify a warning message	2013-03-04 14:12:07 -05:00
page.c	net: Fix (nearly-)kernel-doc comments for various functions	2012-07-10 23:13:45 -07:00
rdma.c	rds: Integer overflow in RDS cmsg handling	2010-11-17 12:20:52 -08:00
rdma_transport.c	net: Fix files explicitly needing to include module.h	2011-10-31 19:30:28 -04:00
rdma_transport.h	rds: make local functions/variables static	2010-10-21 04:26:39 -07:00
rds.h	net: misc: Remove extern from function prototypes	2013-10-19 19:12:11 -04:00
recv.c	net: add build-time checks for msg->msg_name size	2014-01-18 23:04:16 -08:00
send.c	net: add build-time checks for msg->msg_name size	2014-01-18 23:04:16 -08:00
stats.c	net/rds: zero last byte for strncpy	2013-03-08 00:35:44 -05:00
sysctl.c	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
tcp.c	net: Fix files explicitly needing to include module.h	2011-10-31 19:30:28 -04:00
tcp.h	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
tcp_connect.c	rds: Don't disable BH on BH context	2012-08-22 22:52:04 -07:00
tcp_listen.c	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
tcp_recv.c	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
tcp_send.c	rds: Don't disable BH on BH context	2012-08-22 22:52:04 -07:00
tcp_stats.c	net: rds: fix const array syntax	2011-07-01 16:16:19 -07:00
threads.c	net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules	2011-10-31 19:30:30 -04:00
transport.c	RDS: have sockets get transport module references	2010-09-08 18:16:47 -07:00