Dan Carpenter
4596762761
net/x25: prevent a couple of overflows ...
[ Upstream commit 6ee50c8e262a0f0693dad264c3c99e30e6442a56 ]
The .x25_addr[] address comes from the user and is not necessarily
NUL terminated. This leads to a couple problems. The first problem is
that the strlen() in x25_bind() can read beyond the end of the buffer.
The second problem is more subtle and could result in memory corruption.
The call tree is:
x25_connect()
--> x25_write_internal()
--> x25_addr_aton()
The .x25_addr[] buffers are copied to the "addresses" buffer from
x25_write_internal() so it will lead to stack corruption.
Verify that the strings are NUL terminated and return -EINVAL if they
are not.
Fixes: 1da177e4c3a9288525d2https://lore.kernel.org/r/X8ZeAKm8FnFpN//B@mwanda
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-11 13:37:57 +01:00
6lowpan: Off by one handling ->nexthdr
2020-01-29 10:24:22 +01:00
net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid
2020-11-10 10:23:54 +01:00
vlan: fix memory leak in vlan_dev_set_egress_priority
2020-01-12 11:24:27 +01:00
appletalk: Set error code if register_snap_client failed
2019-12-21 10:41:45 +01:00
atm: fix a memory leak of vcc->user_back
2020-10-01 20:40:12 +02:00
AX.25: Prevent integer overflows in connect and sendmsg
2020-07-31 16:44:06 +02:00
batman-adv: set .owner to THIS_MODULE
2020-12-02 08:31:27 +01:00
Bluetooth: Only mark socket zapped after unlocking
2020-10-29 09:05:44 +01:00
netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal
2020-12-11 13:37:57 +01:00
caif: reduce stack size with KASAN
2019-05-08 07:19:07 +02:00
can: purge socket error queue on sock destruct
2019-07-10 09:55:33 +02:00
libceph: clear con->out_msg on Policy::stateful_server faults
2020-11-10 10:23:59 +01:00
net: Have netpoll bring-up DSA management interface
2020-11-24 13:02:55 +01:00
net: dcb: For wild-card lookups, use priority -1, not 0
2018-09-19 22:47:15 +02:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2020-05-20 08:15:30 +02:00
decnet: fix DN_IFREQ_SIZE
2019-12-05 15:35:12 +01:00
KEYS: DNS: fix parsing multiple options
2018-07-22 14:27:39 +02:00
net: dsa: tag_brcm: Fix skb->fwd_offload_mark location
2020-04-13 10:32:53 +02:00
net: add annotations on hh->hh_len lockless accesses
2020-01-12 11:24:19 +01:00
net/hsr: Check skb_put_padto() return value
2020-10-01 20:40:01 +02:00
nl802154: add missing attribute validation for dev_type
2020-03-20 09:07:39 +01:00
tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
2020-11-24 13:02:59 +01:00
ah6: fix error return code in ah6_input()
2020-11-24 13:02:52 +01:00
ipx: call ipxitf_put() in ioctl error path
2017-05-25 15:44:41 +02:00
irda: Only insert new objects into the global database via setsockopt
2018-09-15 09:43:01 +02:00
net/af_iucv: set correct sk_protocol for child sockets
2020-12-11 13:37:56 +01:00
kcm: switch order of device registration to fix a crash
2019-04-17 08:36:44 +02:00
af_key: pfkey_dump needs parameter validation
2020-10-01 20:39:59 +02:00
l2tp: remove skb_dst_set() from l2tp_xmit_skb()
2020-07-22 09:10:47 +02:00
net: ipv6: Remove l3mdev_get_saddr6
2016-09-10 23:12:53 -07:00
lapb: fixed leak of control-blocks.
2019-06-22 08:17:22 +02:00
llc: make sure applications use ARPHRD_ETHER
2020-07-22 09:10:47 +02:00
mac80211: free sta in sta_info_insert_finish() on errors
2020-11-24 13:03:09 +01:00
mac802154: tx: fix use-after-free
2020-10-01 20:40:18 +02:00
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
2020-05-20 08:15:30 +02:00
net/ncsi: Improve HNCDSC AEN handler
2016-10-20 11:23:08 -04:00
ipvs: Fix uninit-value in do_ip_vs_set_ctl()
2020-10-29 09:05:45 +01:00
netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
2020-11-24 13:02:56 +01:00
genetlink: remove genl_bind
2020-07-22 09:10:48 +02:00
net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
2020-05-02 17:23:08 +02:00
nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()
2020-10-29 09:05:32 +01:00
openvswitch: handle DNAT tuple collision
2020-10-14 09:48:16 +02:00
net/packet: fix overflow in tpacket_rcv
2020-10-14 09:48:13 +02:00
phonet: fix building with clang
2019-03-23 13:19:44 +01:00
net: qrtr: Fix passing invalid reference to qrtr_local_enqueue()
2020-06-03 08:16:29 +02:00
rds: Prevent kernel-infoleak in rds_notify_queue_get()
2020-08-21 11:01:49 +02:00
rfkill: Fix incorrect check to avoid NULL pointer dereference
2020-01-12 11:24:23 +01:00
rose: Fix Null pointer dereference in rose_send_frame()
2020-12-11 13:37:56 +01:00
rxrpc: Fix server keyring leak
2020-10-14 09:48:17 +02:00
net: sched: export __netdev_watchdog_up()
2020-06-30 15:38:37 -04:00
sctp: change to hold/put transport for proto_unreach_timer
2020-11-24 13:02:58 +01:00
strparser: Fix incorrect strp->need_bytes value.
2018-04-29 11:32:02 +02:00
SUNRPC: ECONNREFUSED should cause a rebind.
2020-11-10 10:23:50 +01:00
switchdev: Execute bridge ndos only for bridge ports
2016-10-19 10:58:04 -04:00
tipc: fix use-after-free in tipc_bcast_get_mode
2020-11-10 10:24:01 +01:00
skbuff: fix a data race in skb_queue_len()
2020-10-01 20:40:06 +02:00
vsock: use ns_capable_noaudit() on socket create
2020-11-10 10:24:03 +01:00
cfg80211: regulatory: Fix inconsistent format argument
2020-11-18 18:26:26 +01:00
net/x25: prevent a couple of overflows
2020-12-11 13:37:57 +01:00
net: xfrm: fix a race condition during allocing spi
2020-11-18 18:26:23 +01:00
net/compat: Add missing sock updates for SCM_RIGHTS
2020-08-21 11:02:08 +02:00
net: Set fput_needed iff FDPUT_FPUT is set
2020-08-21 11:02:04 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2016-10-06 09:52:23 -07:00
4596762761