David S. Miller
676d23690f
net: Fix use after free by removing length arg from sk_data_ready callbacks. ...
Several spots in the kernel perform a sequence like:
skb_queue_tail(&sk->s_receive_queue, skb);
sk->sk_data_ready(sk, skb->len);
But at the moment we place the SKB onto the socket receive queue it
can be consumed and freed up. So this skb->len access is potentially
to freed up memory.
Furthermore, the skb->len can be modified by the consumer so it is
possible that the value isn't accurate.
And finally, no actual implementation of this callback actually uses
the length argument. And since nobody actually cared about it's
value, lots of call sites pass arbitrary values in such as '0' and
even '1'.
So just remove the length argument from the callback, that way there
is no confusion whatsoever and all of these use-after-free cases get
fixed as a side effect.
Based upon a patch by Eric Dumazet and his suggestion to audit this
issue tree-wide.
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-11 16:15:36 -04:00
can: allow to change the device mtu for CAN FD capable devices
2014-03-07 09:18:23 +01:00
libceph: enable PRIMARY_AFFINITY feature bit
2014-04-04 21:08:20 -07:00
ARM: SoC: late cleanups
2014-04-05 15:46:37 -07:00
crush: add SET_CHOOSELEAF_VARY_R step
2014-04-04 21:07:28 -07:00
lib/decompress_inflate.c: include appropriate header file
2014-04-03 16:21:12 -07:00
extcon: Move OF helper function to extcon core and change function name
2014-03-19 14:41:58 +09:00
fsl /bestcomm
gpio: unmap gpio irqs properly
2014-03-28 20:42:01 +01:00
== Changes to existing drivers ==
2014-04-07 10:24:18 -07:00
Input: pmic8xxx-pwrkey - migrate to DT
2014-03-30 13:25:19 -07:00
Add support for GIC crossbar that routes interrupts on newer omaps.
2014-03-08 23:32:26 -08:00
== Changes to existing drivers ==
2014-04-07 10:24:18 -07:00
net/mlx4: Implement vxlan ndo calls
2014-03-28 16:29:35 -04:00
IB/mlx5: Collect signature error completion
2014-03-07 11:40:04 -08:00
brcmfmac: add BCM4354 SDIO interface support
2014-03-17 13:44:14 -04:00
mtd: nand: fix GET/SET_FEATURES address on 16-bit devices
2014-03-25 23:31:26 -07:00
netfilter: ipset: add forceadd kernel support for hash set types
2014-03-06 09:31:43 +01:00
phy: rename struct omap_control_usb to struct omap_control_phy
2014-03-09 12:45:08 +05:30
MTD updates for 3.15:
2014-04-07 10:17:30 -07:00
Merge remote-tracking branches 'regulator/topic/max8973', 'regulator/topic/max8997', 'regulator/topic/max8998', 'regulator/topic/mc13xxx', 'regulator/topic/pfuze100', 'regulator/topic/rc5t583' and 'regulator/topic/s2mps11' into regulator-next
2014-03-26 16:58:11 +00:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2014-04-02 16:23:38 -07:00
net: Fix use after free by removing length arg from sk_data_ready callbacks.
2014-04-11 16:15:36 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-04-02 20:53:45 -07:00
PCI changes for the v3.15 merge window:
2014-04-01 15:14:04 -07:00
bdi: avoid oops on device removal
2014-04-03 16:20:49 -07:00
backlight: update bd state & fb_blank properties when necessary
2014-04-03 16:21:09 -07:00
exec: kill bprm->tcomm[], simplify the "basename" logic
2014-04-07 16:36:05 -07:00
ext4: atomically set inode->i_flags in ext4_set_inode_flags()
2014-03-30 17:02:06 -07:00
block: remove old blk_iopoll_enabled variable
2014-03-13 09:38:42 -06:00
Merge branch 'for-3.15/core' of git://git.kernel.dk/linux-block
2014-04-01 19:19:15 -07:00
cgroup: remove useless argument from cgroup_exit()
2014-03-29 09:15:54 -04:00
clk: support hardware-specific debugfs entries
2014-03-24 17:10:07 -07:00
Merge branch 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-04-02 12:51:41 -07:00
CPU hotplug notifiers registration fixes for 3.15-rc1
2014-04-07 14:55:46 -07:00
cpufreq: Make cpufreq_notify_transition & cpufreq_notify_post_transition static
2014-03-26 16:41:41 +01:00
sched/idle: Reorganize the idle loop
2014-03-11 11:52:47 +01:00
mm: optimize put_mems_allowed() usage
2014-04-03 16:20:58 -07:00
cputime: Bring cputime -> nsecs conversion
2014-03-13 15:56:44 +01:00
include/linux/crash_dump.h: add vmcore_cleanup() prototype
2014-04-07 16:36:06 -07:00
kernel/groups.c: remove return value of set_groups
2014-04-03 16:21:05 -07:00
vfs: add cross-rename
2014-04-01 17:08:43 +02:00
dm table: add dm_table_run_md_queue_async
2014-03-27 16:56:24 -04:00
Driver core / sysfs patches for 3.15-rc1
2014-04-01 16:28:19 -07:00
iommu/vt-d: Change scope lists to struct device, bus, devfn
2014-03-24 14:05:08 +00:00
err.h: use bool for IS_ERR and IS_ERR_OR_NULL
2014-04-03 16:21:06 -07:00
extcon: Move OF helper function to extcon core and change function name
2014-03-19 14:41:58 +09:00
get rid of fget_light()
2014-03-10 11:44:42 -04:00
net: filter: rework/optimize internal BPF interpreter's instruction set
2014-03-31 00:45:09 -04:00
firewire: don't use PREPARE_DELAYED_WORK
2014-03-07 10:19:57 -05:00
xfs: update for 3.15-rc1
2014-04-04 15:50:08 -07:00
fanotify: convert access_mutex to spinlock
2014-04-03 16:20:51 -07:00
ftrace: Constify ftrace_text_reserved
2014-03-11 22:52:43 -04:00
Most of the changes were largely clean ups, and some documentation.
2014-04-03 10:26:31 -07:00
mm: fix GFP_THISNODE callers and clarify
2014-03-10 17:26:19 -07:00
drm/docs: Include hdmi infoframe helper reference
2014-03-13 12:48:32 +01:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
2014-04-02 16:24:28 -07:00
Merge branches 'for-3.15/multitouch', 'for-3.15/sony' and 'for-3.15/uhid' into for-linus
2014-04-01 19:06:50 +02:00
gpu: host1x: export host1x_syncpt_incr_max() function
2014-04-04 09:12:49 +02:00
hrtimer: Rearrange comments in the order struct members are declared
2014-03-20 12:35:45 +01:00
mm, hugetlb: fix race in region tracking
2014-04-03 16:20:59 -07:00
Drivers: hv: vmbus: Increase the limit on the number of pfns we can handle
2014-03-08 22:15:52 -08:00
idr: remove dead code
2014-04-07 16:36:07 -07:00
Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next
2014-03-20 11:53:20 -04:00
vlan: make a new function vlan_dev_vlan_proto() and export
2014-03-26 16:41:28 -04:00
iommu/vt-d: Store PCI segment number in struct intel_iommu
2014-03-24 14:07:31 +00:00
Kconfig: rename HAS_IOPORT to HAS_IOPORT_MAP
2014-04-07 16:36:11 -07:00
genirq: Add a new IRQCHIP_EOI_THREADED flag
2014-03-14 13:43:33 +01:00
module: remove MODULE_GENERIC_TABLE
2014-03-13 12:11:00 +10:30
net: isdn: use sk_unattached_filter api
2014-03-31 00:45:09 -04:00
Nothing major: the stricter permissions checking for sysfs broke
2014-04-06 09:38:07 -07:00
Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-04-01 11:22:57 -07:00
kernfs: cache atomic_write_len in kernfs_open_file
2014-03-08 22:08:29 -08:00
kexec/compat: convert to COMPAT_SYSCALL_DEFINE with changing parameter types
2014-03-06 16:30:46 +01:00
kmemleak: remove redundant code
2014-04-03 16:20:50 -07:00
kobject: don't block for each kobject_uevent
2014-04-03 16:21:04 -07:00
KVM: Bump KVM_MAX_IRQ_ROUTES for s390
2014-03-21 13:43:13 +01:00
lglock: map to spinlock when !CONFIG_SMP
2014-04-07 16:36:14 -07:00
libata: remove unused ata_sas_port_async_resume() stub
2014-03-19 16:30:23 -04:00
mm: keep page cache radix tree nodes in check
2014-04-03 16:21:01 -07:00
Merge branch 'x86-asmlinkage-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-03-31 14:13:25 -07:00
fs/mbcache.c: change block and index hash chain to hlist_bl_node
2014-03-18 19:19:41 -04:00
ARM: 7993/1: mm/memblock: add memblock_get_current_limit
2014-03-12 00:16:56 +00:00
memcg, slab: do not destroy children caches if parent has aliases
2014-04-07 16:36:13 -07:00
mm, mempolicy: remove per-process flag
2014-04-07 16:35:54 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-04-02 20:53:45 -07:00
numa: use LAST_CPUPID_SHIFT to calculate LAST_CPUPID_MASK
2014-04-07 16:35:58 -07:00
mm: per-thread vma caching
2014-04-07 16:35:53 -07:00
mm: use 'const char *' insted of 'char *' for reason in dump_page()
2014-04-07 16:35:55 -07:00
mm: keep page cache radix tree nodes in check
2014-04-03 16:21:01 -07:00
Driver core / sysfs patches for 3.15-rc1
2014-04-01 16:28:19 -07:00
Nothing major: the stricter permissions checking for sysfs broke
2014-04-06 09:38:07 -07:00
VERIFY_OCTAL_PERMISSIONS: stricter checking for sysfs perms.
2014-03-24 12:21:00 +10:30
locking/mutexes: Introduce cancelable MCS lock for adaptive spinning
2014-03-11 12:14:56 +01:00
net: add busy_poll device feature
2014-04-03 14:31:34 -04:00
packet: fix packet_direct_xmit for BQL enabled drivers
2014-04-03 14:29:12 -04:00
netpoll: Rename netpoll_rx_enable/disable to netpoll_poll_disable/enable
2014-03-29 17:58:37 -04:00
nfs: make nfs_async_rename non-static
2014-03-17 15:14:16 -04:00
Merge branch 'devel' into linux-next
2014-03-17 15:15:21 -04:00
nilfs2: verify metadata sizes read from disk
2014-04-03 16:21:26 -07:00
mac802154: make csma/cca parameters per-wpan
2014-04-01 16:25:51 -04:00
nvme: don't use PREPARE_WORK
2014-03-07 10:24:49 -05:00
Devicetree changes for v3.15
2014-04-02 14:27:15 -07:00
drivers: of: add initialization code for static reserved memory
2014-03-11 17:26:47 +00:00
of: Fix of_graph_parse_endpoint stub for !CONFIG_OF builds
2014-03-07 16:02:46 +01:00
of_mtd: Add helpers to get ECC strength and ECC step size
2014-03-10 22:42:28 -07:00
drivers: of: add support for custom reserved memory drivers
2014-03-11 17:27:12 +00:00
dmaengine: omap-dma: move register read/writes into omap-dma.c
2014-04-04 00:31:49 +01:00
mm: remove read_cache_page_async()
2014-04-03 16:21:04 -07:00
mm + fs: prepare for non-page entries in page cache radix trees
2014-04-03 16:21:00 -07:00
Merge branch 'pci/resource' into next
2014-03-19 15:11:19 -06:00
SCSI misc on 20140401
2014-04-01 18:49:04 -07:00
percpu: add preemption checks to __this_cpu ops
2014-04-07 16:36:14 -07:00
CPU hotplug, perf: Fix CPU hotplug callback registration
2014-03-20 13:43:40 +01:00
Merge branches 'pm-runtime' and 'pm-sleep'
2014-03-20 13:25:54 +01:00
include/linux/printk.h: remove double asmlinkage in printk_emit
2014-04-03 16:21:08 -07:00
net: ptp: move PTP classifier in its own file
2014-04-01 16:43:18 -04:00
ptp: introduce programmable pins.
2014-03-21 14:21:13 -04:00
ARM: pxa: fix pxa_ssp_* declarations
2014-03-21 18:26:03 +01:00
quota: provide function to grab quota structure reference
2014-04-03 16:20:54 -07:00
mm: keep page cache radix tree nodes in check
2014-04-03 16:21:01 -07:00
random: Add arch_has_random[_seed]()
2014-03-19 22:24:08 -04:00
Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-03-31 11:05:24 -07:00
rcu: Provide grace-period piggybacking API
2014-03-20 17:12:25 -07:00
rcu: Provide grace-period piggybacking API
2014-03-20 17:12:25 -07:00
Char/Misc driver patches for 3.15-rc1
2014-04-01 16:13:21 -07:00
res_counter: remove interface for locked charging and uncharging
2014-04-07 16:35:54 -07:00
reset: Add optional resets and stubs
2014-03-09 19:53:45 +01:00
rapidio: rework device hierarchy and introduce mport class of devices
2014-04-07 16:36:07 -07:00
mm: fix swapops.h:131 bug if remap_file_pages raced migration
2014-03-20 22:09:09 -07:00
wait: swap EXIT_ZOMBIE and EXIT_DEAD to hide EXIT_TRACE from user-space
2014-04-07 16:36:06 -07:00
net: filter: rework/optimize internal BPF interpreter's instruction set
2014-03-31 00:45:09 -04:00
security: add flags to rename hooks
2014-04-01 17:08:43 +02:00
serial: s3c: Fix build of header without serial_core.h preinclusion
2014-03-21 04:12:33 +09:00
serial: sh-sci: Add more register documentation
2014-03-17 16:20:49 -07:00
mm + fs: prepare for non-page entries in page cache radix trees
2014-04-03 16:21:00 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-04-02 20:53:45 -07:00
memcg, slab: separate memcg vs root cache creation paths
2014-04-07 16:36:12 -07:00
slub: rework sysfs layout for memcg caches
2014-04-07 16:36:13 -07:00
mfd: ssbi: Add regmap read/write helpers
2014-03-19 08:58:30 +00:00
mm: keep page cache radix tree nodes in check
2014-04-03 16:21:01 -07:00
net: sxgbe: add basic framework for Samsung 10Gb ethernet driver
2014-03-26 16:49:31 -04:00
include/linux/syscalls.h: add sys_renameat2() prototype
2014-04-08 09:24:25 -07:00
Nothing major: the stricter permissions checking for sysfs broke
2014-04-06 09:38:07 -07:00
mm: use raw_cpu ops for determining current NUMA node
2014-04-07 16:36:13 -07:00
Most of the changes were largely clean ups, and some documentation.
2014-04-03 10:26:31 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-04-02 20:53:45 -07:00
net: Replace u64_stats_fetch_begin_bh to u64_stats_fetch_begin_irq
2014-03-14 22:41:36 -04:00
uprobes: allow ignoring of probe hits
2014-03-18 16:39:34 -04:00
USB patches for 3.15-rc1
2014-04-01 17:06:09 -07:00
drop_caches: add some documentation and info message
2014-04-03 16:21:04 -07:00
mm: per-thread vma caching
2014-04-07 16:35:53 -07:00
vmstat: use raw_cpu_ops to avoid false positives on preemption checks
2014-04-07 16:36:14 -07:00
sched: remove sleep_on() and friends
2014-04-07 11:24:06 -07:00
Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-04-01 11:00:07 -07:00
mm: remove unused arg of set_page_dirty_balance()
2014-04-07 16:35:57 -07:00
