Mateusz Jurczyk e3c42b61ff af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers ... Verify that the caller-provided sockaddr structure is large enough to contain the sa_family field, before accessing it in bind() and connect() handlers of the AF_IUCV socket. Since neither syscall enforces a minimum size of the corresponding memory region, very short sockaddrs (zero or one byte long) result in operating on uninitialized memory while referencing .sa_family. Fixes: 52a82e23b9 ("af_iucv: Validate socket address length in iucv_sock_bind()") Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com> [jwi: removed unneeded null-check for addr] Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-06-25 11:42:58 -04:00
..
6lowpan	6lowpan: Don't set IFF_NO_QUEUE	2017-04-12 22:02:40 +02:00
9p	xen: fixes for 4.12 rc2	2017-05-19 15:06:48 -07:00
802	net: introduce __skb_put_[zero, data, u8]	2017-06-20 13:30:14 -04:00
8021q	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-06-21 17:35:22 -04:00
appletalk	networking: make skb_push & __skb_push return void pointers	2017-06-16 11:48:40 -04:00
atm	networking: make skb_put & friends return void pointers	2017-06-16 11:48:39 -04:00
ax25	networking: make skb_push & __skb_push return void pointers	2017-06-16 11:48:40 -04:00
batman-adv	networking: make skb_put & friends return void pointers	2017-06-16 11:48:39 -04:00
bluetooth	net: introduce __skb_put_[zero, data, u8]	2017-06-20 13:30:14 -04:00
bpf	bpf: Align packet data properly in program testing framework.	2017-05-02 11:46:28 -04:00
bridge	net: manual clean code which call skb_put_[data:zero]	2017-06-20 13:30:15 -04:00
caif	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-06-15 11:59:32 -04:00
can	networking: introduce and use skb_put_data()	2017-06-16 11:48:37 -04:00
ceph	libceph: cleanup old messages according to reconnect seq	2017-05-24 18:10:51 +02:00
core	net: store port/representator id in metadata_dst	2017-06-25 11:42:01 -04:00
dcb	dcb: enforce minimum length on IEEE_APPS attribute	2017-05-21 13:42:33 -04:00
dccp	dccp: call inet_add_protocol after register_pernet_subsys in dccp_v6_init	2017-06-20 15:31:43 -04:00
decnet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-06-21 17:35:22 -04:00
dns_resolver	Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-03-03 10:16:38 -08:00
dsa	net: manual clean code which call skb_put_[data:zero]	2017-06-20 13:30:15 -04:00
ethernet	networking: make skb_push & __skb_push return void pointers	2017-06-16 11:48:40 -04:00
hsr	net: manual clean code which call skb_put_[data:zero]	2017-06-20 13:30:15 -04:00
ieee802154	networking: introduce and use skb_put_data()	2017-06-16 11:48:37 -04:00
ife	net: Introduce ife encapsulation module	2017-02-03 15:16:45 -05:00
ipv4	net: store port/representator id in metadata_dst	2017-06-25 11:42:01 -04:00
ipv6	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2017-06-23 14:17:31 -04:00
ipx	ipx: call ipxitf_put() in ioctl error path	2017-05-02 15:34:53 -04:00
irda	net: manual clean code which call skb_put_[data:zero]	2017-06-20 13:30:15 -04:00
iucv	af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers	2017-06-25 11:42:58 -04:00
kcm	net: socket: mark socket protocol handler structs as const	2017-05-16 11:54:07 -04:00
key	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2017-06-23 14:17:31 -04:00
l2tp	l2tp: cast l2tp traffic counter to unsigned	2017-06-10 16:14:27 -04:00
l3mdev	net: ipv6: Remove l3mdev_get_saddr6	2016-09-10 23:12:53 -07:00
lapb	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
llc	net: llc: add lock_sock in llc_ui_bind to avoid a race condition	2017-05-26 14:20:29 -04:00
mac80211	net: manual clean code which call skb_put_[data:zero]	2017-06-20 13:30:15 -04:00
mac802154	net: Fix inconsistent teardown and release of private netdev state.	2017-06-07 15:53:24 -04:00
mpls	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-06-06 22:20:08 -04:00
ncsi	networking: make skb_push & __skb_push return void pointers	2017-06-16 11:48:40 -04:00
netfilter	networking: make skb_put & friends return void pointers	2017-06-16 11:48:39 -04:00
netlabel	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
netlink	networking: make skb_put & friends return void pointers	2017-06-16 11:48:39 -04:00
netrom	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
nfc	networking: add and use skb_put_u8()	2017-06-16 11:48:40 -04:00
openvswitch	net: store port/representator id in metadata_dst	2017-06-25 11:42:01 -04:00
packet	net/packet: remove unneeded declaraion of tpacket_snd().	2017-06-10 16:15:25 -04:00
phonet	net: Fix inconsistent teardown and release of private netdev state.	2017-06-07 15:53:24 -04:00
psample	networking: make skb_put & friends return void pointers	2017-06-16 11:48:39 -04:00
qrtr	networking: make skb_put & friends return void pointers	2017-06-16 11:48:39 -04:00
rds	rds: tcp: set linger to 1 when unloading a rds-tcp	2017-06-22 11:34:04 -04:00
rfkill	net: rfkill: gpio: Switch to devm_acpi_dev_add_driver_gpios()	2017-06-13 11:07:51 +02:00
rose	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-06-21 17:35:22 -04:00
sched	bpf: expose prog id for cls_bpf and act_bpf	2017-06-21 15:14:23 -04:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-06-21 17:35:22 -04:00
smc	net/smc: Add warning about remote memory exposure	2017-05-16 14:49:43 -04:00
strparser	strparser: destroy workqueue on module exit	2017-03-03 20:43:26 -08:00
sunrpc	SUNRPC: ensure correct error is reported by xs_tcp_setup_socket()	2017-05-31 12:26:44 -04:00
switchdev	net: switchdev: Change notifier chain to be atomic	2017-06-08 14:16:24 -04:00
tipc	net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse	2017-06-10 18:20:38 -04:00
tls	tls: return -EFAULT if copy_to_user() fails	2017-06-23 14:19:27 -04:00
unix	af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers	2017-06-09 10:10:24 -04:00
vmw_vsock	net: manual clean code which call skb_put_[data:zero]	2017-06-20 13:30:15 -04:00
wimax	genetlink: mark families as __ro_after_init	2016-10-27 16:16:09 -04:00
wireless	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-06-21 17:35:22 -04:00
x25	net: manual clean code which call skb_put_[data:zero]	2017-06-20 13:30:15 -04:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2017-06-23 14:17:31 -04:00
Kconfig	tls: kernel TLS support	2017-06-15 12:12:40 -04:00
Makefile	tls: kernel TLS support	2017-06-15 12:12:40 -04:00
compat.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-02-22 10:15:09 -08:00
socket.c	net: socket: fix a typo in sockfd_lookup().	2017-05-22 12:14:04 -04:00
sysctl_net.c	sysctl: Remove dead register_sysctl_root	2017-04-16 23:42:49 -05:00