joy/android_kernel_sony_sdm845
Watch
1
Fork
You've already forked android_kernel_sony_sdm845
 0
Code Issues Pull requests Projects Releases Wiki Activity
android_kernel_sony_sdm845/drivers
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
David S. Miller 676d23690f net: Fix use after free by removing length arg from sk_data_ready callbacks. 
Several spots in the kernel perform a sequence like:

	skb_queue_tail(&sk->s_receive_queue, skb);
	sk->sk_data_ready(sk, skb->len);

But at the moment we place the SKB onto the socket receive queue it
can be consumed and freed up.  So this skb->len access is potentially
to freed up memory.

Furthermore, the skb->len can be modified by the consumer so it is
possible that the value isn't accurate.

And finally, no actual implementation of this callback actually uses
the length argument.  And since nobody actually cared about it's
value, lots of call sites pass arbitrary values in such as '0' and
even '1'.

So just remove the length argument from the callback, that way there
is no confusion whatsoever and all of these use-after-free cases get
fixed as a side effect.

Based upon a patch by Eric Dumazet and his suggestion to audit this
issue tree-wide.

Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-11 16:15:36 -04:00
..
accessibility
acpi More ACPI and power management updates for 3.15-rc1 2014-04-02 14:10:21 -07:00
amba ARM: SoC: driver changes 2014-04-05 15:37:40 -07:00
ata Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2014-04-02 16:23:38 -07:00
atm atm: idt77105: Use del_timer_sync() in exit path 2014-03-25 21:06:02 -04:00
auxdisplay
base CPU hotplug notifiers registration fixes for 3.15-rc1 2014-04-07 14:55:46 -07:00
bcma bcma: gpio: register 32 GPIOs on BCM5357 2014-03-27 14:20:04 -04:00
block Merge branch 'akpm' (incoming from Andrew) 2014-04-07 16:38:06 -07:00
bluetooth Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2014-04-02 20:53:45 -07:00
bus ARM: SoC: driver changes 2014-04-05 15:37:40 -07:00
cdrom
char Kconfig: rename HAS_IOPORT to HAS_IOPORT_MAP 2014-04-07 16:36:11 -07:00
clk == Changes to existing drivers == 2014-04-07 10:24:18 -07:00
clocksource CPU hotplug notifiers registration fixes for 3.15-rc1 2014-04-07 14:55:46 -07:00
connector Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2014-04-02 20:53:45 -07:00
cpufreq CPU hotplug notifiers registration fixes for 3.15-rc1 2014-04-07 14:55:46 -07:00
cpuidle ARM: SoC: driver changes 2014-04-05 15:37:40 -07:00
crypto Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2014-04-03 09:28:16 -07:00
dca
devfreq PM / devfreq: Rewrite devfreq_update_status() to fix multiple bugs 2014-03-21 11:16:30 +09:00
dio
dma Merge branch 'devel-stable' into for-next 2014-04-04 00:33:49 +01:00
edac Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media 2014-04-04 09:50:07 -07:00
eisa
extcon
firewire
firmware Driver core / sysfs patches for 3.15-rc1 2014-04-01 16:28:19 -07:00
fmc
gpio == Changes to existing drivers == 2014-04-07 10:24:18 -07:00
gpu Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux 2014-04-08 09:52:16 -07:00
hid Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media 2014-04-04 09:50:07 -07:00
hsi
hv Char/Misc driver patches for 3.15-rc1 2014-04-01 16:13:21 -07:00
hwmon CPU hotplug notifiers registration fixes for 3.15-rc1 2014-04-07 14:55:46 -07:00
hwspinlock
i2c Kconfig: rename HAS_IOPORT to HAS_IOPORT_MAP 2014-04-07 16:36:11 -07:00
ide
idle intel-idle: Fix CPU hotplug callback registration 2014-03-20 13:43:46 +01:00
iio == Changes to existing drivers == 2014-04-07 10:24:18 -07:00
infiniband Main batch of InfiniBand/RDMA changes for 3.15: 2014-04-03 16:57:19 -07:00
input pwm: Changes for v3.15-rc1 2014-04-05 18:32:31 -07:00
iommu IOMMU Upates for Linux v3.15 2014-04-05 18:46:26 -07:00
ipack
irqchip ARM: SoC: driver changes 2014-04-05 15:37:40 -07:00
isdn isdnloop: several buffer overflows 2014-04-08 12:41:13 -04:00
leds
lguest drivers/lguest/page_tables.c: rename do_set_pte() 2014-04-07 16:35:52 -07:00
macintosh
mailbox
mcb
md . Fix dm-cache corruption caused by discard_block_size > 2014-04-05 18:49:31 -07:00
media Merge branch 'topic/exynos' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media 2014-04-05 13:10:00 -07:00
memory
memstick
message PCI changes for the v3.15 merge window: 2014-04-01 15:14:04 -07:00
mfd == Changes to existing drivers == 2014-04-07 10:24:18 -07:00
misc drivers/misc/sgi-gru/grukdump.c: cleanup gru_dump_context() a little 2014-04-07 16:36:09 -07:00
mmc Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm 2014-04-05 13:20:43 -07:00
mtd MTD updates for 3.15: 2014-04-07 10:17:30 -07:00
net Drivers: net: hyperv: Address UDP checksum issues 2014-04-11 15:15:12 -04:00
nfc
ntb
nubus
of MTD updates for 3.15: 2014-04-07 10:17:30 -07:00
oprofile oprofile, nmi-timer: Fix CPU hotplug callback registration 2014-03-20 13:43:46 +01:00
parisc
parport
pci Nothing major: the stricter permissions checking for sysfs broke 2014-04-06 09:38:07 -07:00
pcmcia PCI changes for the v3.15 merge window: 2014-04-01 15:14:04 -07:00
phy ARM: SoC: driver changes 2014-04-05 15:37:40 -07:00
pinctrl This is the bulk of GPIO changes for v3.15: 2014-04-03 16:44:15 -07:00
platform sound updates for 3.15-rc1 2014-04-01 15:38:47 -07:00
pnp More ACPI and power management updates for 3.15-rc1 2014-04-02 14:10:21 -07:00
power
powercap CPU hotplug notifiers registration fixes for 3.15-rc1 2014-04-07 14:55:46 -07:00
pps
ps3
ptp net: ptp: move PTP classifier in its own file 2014-04-01 16:43:18 -04:00
pwm pwm: Changes for v3.15-rc1 2014-04-05 18:32:31 -07:00
rapidio rapidio: rework device hierarchy and introduce mport class of devices 2014-04-07 16:36:07 -07:00
regulator Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2014-04-02 16:23:38 -07:00
remoteproc
reset Merge branch 'reset/for_v3.15' of git://git.pengutronix.de/git/pza/linux into next/drivers 2014-03-27 01:28:19 +01:00
rpmsg
rtc ARM: SoC: driver changes 2014-04-05 15:37:40 -07:00
s390 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2014-04-08 12:02:28 -07:00
sbus
scsi net: Fix use after free by removing length arg from sk_data_ready callbacks. 2014-04-11 16:15:36 -04:00
sfi
sh ARM: SoC: sh driver changes 2014-04-05 15:38:41 -07:00
sn
spi Merge branch 'mips-for-linux-next' of git://git.linux-mips.org/pub/scm/ralf/upstream-sfr 2014-04-02 13:40:50 -07:00
spmi
ssb
staging net: Fix use after free by removing length arg from sk_data_ready callbacks. 2014-04-11 16:15:36 -04:00
target net: Fix use after free by removing length arg from sk_data_ready callbacks. 2014-04-11 16:15:36 -04:00
tc
thermal CPU hotplug notifiers registration fixes for 3.15-rc1 2014-04-07 14:55:46 -07:00
tty ARM: SoC: driver changes 2014-04-05 15:37:40 -07:00
uio
usb Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm 2014-04-05 13:20:43 -07:00
uwb
vfio VFIO updates for v3.15 include: 2014-04-03 14:05:02 -07:00
vhost vhost: validate vhost_get_vq_desc return value 2014-03-28 16:10:35 -04:00
video Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux 2014-04-08 09:52:16 -07:00
virt
virtio
vlynq
vme
w1
watchdog CPU hotplug notifiers registration fixes for 3.15-rc1 2014-04-07 14:55:46 -07:00
xen Fix arm build of drivers/xen/events/ 2014-04-07 17:50:18 -07:00
zorro
Kconfig
Makefile