Kees Cook
98c8f125fd
net: sched: Fix memory exposure from short TCA_U32_SEL
...
Via u32_change(), TCA_U32_SEL has an unspecified type in the netlink
policy, so max length isn't enforced, only minimum. This means nkeys
(from userspace) was being trusted without checking the actual size of
nla_len(), which could lead to a memory over-read, and ultimately an
exposure via a call to u32_dump(). Reachability is CAP_NET_ADMIN within
a namespace.
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-08-26 14:21:50 -07:00
..
act_api.c
net_sched: remove list_head from tc_action
2018-08-21 12:45:44 -07:00
act_bpf.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_connmark.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_csum.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_gact.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_ife.c
act_ife: fix a potential deadlock
2018-08-21 12:45:45 -07:00
act_ipt.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_meta_mark.c
net: remove duplicate includes
2017-12-13 13:18:46 -05:00
act_meta_skbprio.c
net sched actions: change IFE modules alias names
2017-10-12 22:13:20 -07:00
act_meta_skbtcindex.c
net: remove duplicate includes
2017-12-13 13:18:46 -05:00
act_mirred.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_nat.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_pedit.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_police.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_sample.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_simple.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_skbedit.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_skbmod.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_tunnel_key.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
act_vlan.c
net_sched: remove unnecessary ops->delete()
2018-08-21 12:45:44 -07:00
cls_api.c
net: sched: extend action ops with put_dev callback
2018-08-11 12:37:10 -07:00
cls_basic.c
sched: fix trailing whitespace
2018-07-24 14:10:42 -07:00
cls_bpf.c
cls_bpf: Use kmemdup instead of duplicating it in cls_bpf_prog_from_ops
2018-07-29 13:19:49 -07:00
cls_cgroup.c
net_sched: switch to rcu_work
2018-05-24 22:56:15 -04:00
cls_flow.c
net_sched: switch to rcu_work
2018-05-24 22:56:15 -04:00
cls_flower.c
net: sched: cls_flower: set correct offload data in fl_reoffload
2018-08-07 12:35:17 -07:00
cls_fw.c
net_sched: switch to rcu_work
2018-05-24 22:56:15 -04:00
cls_matchall.c
cls_matchall: fix tcf_unbind_filter missing
2018-08-16 12:08:26 -07:00
cls_route.c
net_sched: switch to rcu_work
2018-05-24 22:56:15 -04:00
cls_rsvp.c
cls_rsvp.h
net_sched: switch to rcu_work
2018-05-24 22:56:15 -04:00
cls_rsvp6.c
cls_tcindex.c
net_sched: Fix missing res info when create new tc_index filter
2018-08-13 19:37:42 -07:00
cls_u32.c
net: sched: Fix memory exposure from short TCA_U32_SEL
2018-08-26 14:21:50 -07:00
em_canid.c
em_cmp.c
em_ipset.c
em_ipt.c
net: sched: add em_ipt ematch for calling xtables matches
2018-02-21 13:15:33 -05:00
em_meta.c
net: convert sock.sk_refcnt from atomic_t to refcount_t
2017-07-01 07:39:08 -07:00
em_nbyte.c
net: sched: em_nbyte: don't add the data offset twice
2018-01-24 14:52:40 -05:00
em_text.c
em_u32.c
ematch.c
net: sched: ematch: obtain net pointer from blocks
2017-10-16 21:00:40 +01:00
Kconfig
net/sched: add skbprio scheduler
2018-07-24 14:44:00 -07:00
Makefile
net/sched: add skbprio scheduler
2018-07-24 14:44:00 -07:00
sch_api.c
net/sched: Allow creating a Qdisc watchdog with other clocks
2018-07-04 22:30:27 +09:00
sch_atm.c
net: sch: api: add extack support in qdisc_create_dflt
2017-12-21 12:32:51 -05:00
sch_blackhole.c
net_sched: blackhole: tell upper qdisc about dropped packets
2018-06-17 08:42:33 +09:00
sch_cake.c
sch_cake: Fix TC filter flow override and expand it to hosts as well
2018-08-22 21:39:45 -07:00
sch_cbq.c
net: sch: sch_cbq: add extack support
2017-12-21 12:32:51 -05:00
sch_cbs.c
cbs: Add support for the graft function
2018-07-26 13:58:30 -07:00
sch_choke.c
net: sched: sch: add extack for change qdisc ops
2017-12-21 12:32:50 -05:00
sch_codel.c
net: sched: sch: add extack for change qdisc ops
2017-12-21 12:32:50 -05:00
sch_drr.c
net: sch: sch_drr: add extack support
2017-12-21 12:32:51 -05:00
sch_dsmark.c
net: sch: api: add extack support in qdisc_create_dflt
2017-12-21 12:32:51 -05:00
sch_etf.c
net/sched: Make etf report drops on error_queue
2018-07-04 22:30:28 +09:00
sch_fifo.c
net: sch: api: add extack support in qdisc_create_dflt
2017-12-21 12:32:51 -05:00
sch_fq.c
net_sched: fq: take care of throttled flows before reuse
2018-05-02 16:37:38 -04:00
sch_fq_codel.c
sch_fq_codel: zero q->flows_cnt when fq_codel_init fails
2018-07-12 12:32:09 -07:00
sch_generic.c
net: remove bypassed check in sch_direct_xmit()
2018-05-31 13:26:19 -04:00
sch_gred.c
net: sched: sch: add extack for change qdisc ops
2017-12-21 12:32:50 -05:00
sch_hfsc.c
net_sched: remove a bogus warning in hfsc
2018-06-23 10:58:46 +09:00
sch_hhf.c
treewide: kvzalloc() -> kvcalloc()
2018-06-12 16:19:22 -07:00
sch_htb.c
net_sched: remove unused htb drop_list
2018-06-24 16:42:46 +09:00
sch_ingress.c
net: sched: allow ingress and clsact qdiscs to share filter blocks
2018-01-17 14:53:57 -05:00
sch_mq.c
net: sched: mq: request stats from offloads
2018-05-29 09:49:16 -04:00
sch_mqprio.c
net: sch: api: add extack support in qdisc_create_dflt
2017-12-21 12:32:51 -05:00
sch_multiq.c
net: sch: api: add extack support in qdisc_create_dflt
2017-12-21 12:32:51 -05:00
sch_netem.c
netem: slotting with non-uniform distribution
2018-06-28 22:06:24 +09:00
sch_pie.c
net: sched: sch: add extack for change qdisc ops
2017-12-21 12:32:50 -05:00
sch_plug.c
net: sched: sch: add extack for change qdisc ops
2017-12-21 12:32:50 -05:00
sch_prio.c
net: sch: prio: Add offload ability for grafting a child
2018-02-28 12:06:01 -05:00
sch_qfq.c
net: sch: api: add extack support in qdisc_create_dflt
2017-12-21 12:32:51 -05:00
sch_red.c
net: sched: red: avoid hashing NULL child
2018-05-18 13:52:32 -04:00
sch_sfb.c
net: sch: api: add extack support in qdisc_create_dflt
2017-12-21 12:32:51 -05:00
sch_sfq.c
net: sch: api: add extack support in tcf_block_get
2017-12-21 12:32:51 -05:00
sch_skbprio.c
net/sched: add skbprio scheduler
2018-07-24 14:44:00 -07:00
sch_tbf.c
net: sched: red: avoid hashing NULL child
2018-05-18 13:52:32 -04:00
sch_teql.c
net: sched: sch: add extack for init callback
2017-12-21 12:32:50 -05:00