Johannes Berg
68dd02d19c
dev_ioctl: copy only the smaller struct iwreq for wext ...
Unfortunately, struct iwreq isn't a proper subset of struct ifreq,
but is still handled by the same code path. Robert reported that
then applications may (randomly) fault if the struct iwreq they
pass happens to land within 8 bytes of the end of a mapping (the
struct is only 32 bytes, vs. struct ifreq's 40 bytes).
To fix this, pull out the code handling wireless extension ioctls
and copy only the smaller structure in this case.
This bug goes back a long time, I tracked that it was introduced
into mainline in 2.1.15, over 20 years ago!
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=195869
Reported-by: Robert O'Callahan <robert@ocallahan.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-06-14 13:52:44 +02:00
Bluetooth: L2CAP: Fix L2CAP_CR_SCID_IN_USE value
2017-04-12 22:02:37 +02:00
scripts/spelling.txt: add "overide" pattern and fix typo instances
2017-03-09 17:01:09 -08:00
netfilter: nf_tables: revisit chain/object refcounting from elements
2017-05-15 12:51:41 +02:00
can: network namespace support for CAN gateway
2017-04-25 09:04:30 +02:00
NFC: Add nfc_dbg() macro
2017-04-05 10:15:20 +02:00
sctp: process duplicated strreset out and addstrm out requests correctly
2017-04-18 13:39:50 -04:00
net/sched: act_csum: Add accessors for offloading drivers
2017-05-23 16:23:31 +03:00
6lowpan: Fix IID format for Bluetooth
2017-04-12 22:02:36 +02:00
ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf
2017-05-08 17:31:24 -04:00
rxrpc: Note a successfully aborted kernel operation
2017-04-06 10:11:59 +01:00
VSOCK: Add vsockmon tap functions
2017-04-24 12:35:56 -04:00
net: add confirm_neigh method to dst_ops
2017-02-07 13:07:46 -05:00
bonding: fix wq initialization for links created via netlink
2017-04-21 15:28:37 -04:00
net: Commonize busy polling code to focus on napi_id instead of socket
2017-03-24 20:49:31 -07:00
cfg80211: fix multi scheduled scan kernel-doc
2017-05-08 13:09:38 +02:00
netlabel: out of bound access in cipso_v4_validate()
2017-02-04 19:44:22 -05:00
net/devlink: Add E-Switch encapsulation control
2017-04-22 20:26:37 +03:00
net: dsa: add support for the SMSC-LAN9303 tagging format
2017-04-20 13:48:54 -04:00
ipv4: add reference counting to metrics
2017-05-26 14:57:07 -04:00
net: add confirm_neigh method to dst_ops
2017-02-07 13:07:46 -05:00
esp6: Reorganize esp_output
2017-04-14 10:06:42 +02:00
net: rtnetlink: plumb extended ack to doit function
2017-04-17 15:35:38 -04:00
flowcache: make flow_key_size() return "unsigned int"
2017-04-03 19:04:48 -07:00
flow_dissector: add mpls support (v2)
2017-04-24 14:30:46 -04:00
flowcache: more "unsigned int"
2017-04-03 19:04:48 -07:00
netlink: pass extended ACK struct to parsing functions
2017-04-13 13:58:22 -04:00
gro_cells: move to net/core/gro_cells.c
2017-02-08 14:38:18 -05:00
net: Introduce ife encapsulation module
2017-02-03 15:16:45 -05:00
net: Work around lockdep limitation in sockets that use sockets
2017-03-09 18:23:27 -08:00
net: Work around lockdep limitation in sockets that use sockets
2017-03-09 18:23:27 -08:00
net: ipv4: Refine the ipv4_default_advmss
2017-04-13 13:19:48 -04:00
net: ipv6: Allow shorthand delete of all nexthops in multipath route
2017-02-04 19:58:14 -05:00
ipv6: initialize route null entry in addrconf_init()
2017-05-04 12:51:24 -04:00
ip6_tunnel: Allow policy-based routing through tunnels
2017-04-21 13:21:30 -04:00
ipv4: add reference counting to metrics
2017-05-26 14:57:07 -04:00
ip_tunnel: Allow policy-based routing through tunnels
2017-04-21 13:21:31 -04:00
ipvs: remove unused function ip_vs_set_state_timeout
2017-04-28 12:00:10 +02:00
net: ping: do not abuse udp_poll()
2017-06-04 22:56:55 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-02-11 02:31:11 -05:00
mac80211: properly remove RX_ENC_FLAG_40MHZ
2017-05-08 11:11:56 +02:00
net: mpls: Increase max number of labels for lwt encap
2017-04-01 20:21:44 -07:00
ipv6: add support for NETDEV_RESEND_IGMP event
2017-03-28 22:02:21 -07:00
net: neigh: make ->hh_len 32-bit
2017-04-12 13:59:21 -04:00
can: initial support for network namespaces
2017-04-04 17:35:58 +02:00
netlink: pass extended ACK struct to parsing functions
2017-04-13 13:58:22 -04:00
net/sched: Reflect HW offload status
2017-02-17 12:08:05 -05:00
net: sched: make default fifo qdiscs appear in the dump
2017-03-12 22:53:02 -07:00
net: Add sysctl to toggle early demux for tcp and udp
2017-03-24 13:17:07 -07:00
Revert "ipv4: restore rt->fi for reference counting"
2017-05-08 22:35:32 -04:00
net: rtnetlink: plumb extended ack to doit function
2017-04-17 15:35:38 -04:00
net_sched: move the empty tp check from ->destroy() to ->delete()
2017-04-21 13:58:15 -04:00
sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>
2017-03-02 08:42:31 +01:00
tcp: randomize timestamps on syncookies
2017-05-05 12:00:11 -04:00
Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2017-05-10 10:30:46 -07:00
switchdev: bridge: Offload mc router ports
2017-02-10 11:46:39 -05:00
net: Update TCP congestion control documentation
2017-06-05 10:53:24 -04:00
net: Add sysctl to toggle early demux for tcp and udp
2017-03-24 13:17:07 -07:00
dev_ioctl: copy only the smaller struct iwreq for wext
2017-06-14 13:52:44 +02:00
net: x25: fix one potential use-after-free issue
2017-05-18 10:05:40 -04:00
xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
2017-05-04 07:30:59 +02:00
68dd02d19c