Haimin Zhang
ef388db2fe
af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register ...
[ Upstream commit 9a564bccb78a76740ea9d75a259942df8143d02c ]
Add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
to initialize the buffer of supp_skb to fix a kernel-info-leak issue.
1) Function pfkey_register calls compose_sadb_supported to request
a sk_buff. 2) compose_sadb_supported calls alloc_sbk to allocate
a sk_buff, but it doesn't zero it. 3) If auth_len is greater 0, then
compose_sadb_supported treats the memory as a struct sadb_supported and
begins to initialize. But it just initializes the field sadb_supported_len
and field sadb_supported_exttype without field sadb_supported_reserved.
Reported-by: TCS Robot <tcs_robot@tencent.com>
Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-15 14:17:56 +02:00
xen/9p: use alloc/free_pages_exact()
2022-03-11 11:22:39 +01:00
net: vlan: fix underflow for the real_dev refcnt
2021-12-01 09:23:34 +01:00
ax25: Fix NULL pointer dereference in ax25_kill_by_device
2022-03-16 13:21:45 +01:00
batman-adv: Don't expect inter-netns unique iflink indices
2022-03-08 19:07:47 +01:00
Bluetooth: refactor malicious adv data check
2022-02-01 17:24:33 +01:00
net: bridge: fix stale eth hdr pointer in br_dev_xmit
2022-02-16 12:52:50 +01:00
net-caif: avoid user-triggerable WARN_ON(1)
2021-09-22 12:26:40 +02:00
can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
2021-12-08 09:01:08 +01:00
esp: Fix possible buffer overflow in ESP transformation
2022-03-28 08:46:44 +02:00
net: dcb: disable softirqs in dcbnl_flush_dev()
2022-03-08 19:07:51 +01:00
dccp: don't duplicate ccid when cloning dccp sock
2021-09-22 12:26:40 +02:00
net: dsa: Add missing of_node_put() in dsa_port_parse_of
2022-03-23 09:12:07 +01:00
net: ieee802154: Return meaningful error codes from the netlink helpers
2022-02-08 18:24:31 +01:00
esp: Fix possible buffer overflow in ESP transformation
2022-03-28 08:46:44 +02:00
xfrm: fix tunnel model fragmentation behavior
2022-04-15 14:17:56 +02:00
af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
2022-04-15 14:17:56 +02:00
net/l2tp: Fix reference count leak in l2tp_udp_recv_core
2021-09-22 12:26:41 +02:00
llc: only change llc->dev when bind() succeeds
2022-03-28 08:46:48 +02:00
mac80211: fix potential double free on mesh join
2022-03-28 08:46:48 +02:00
net: mpls: Fix notifications when deleting a device
2021-12-08 09:01:12 +01:00
net/ncsi: check for error return from call to nla_put_u32
2022-01-05 12:37:45 +01:00
netfilter: nf_tables: initialize registers in nft_do_chain()
2022-03-28 08:46:47 +02:00
net: fix NULL pointer reference in cipso_v4_doi_free
2021-09-22 12:26:36 +02:00
net: netlink: af_netlink: Prevent empty skb by adding a check on len.
2021-12-17 10:12:23 +01:00
nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
2022-01-27 09:19:26 +01:00
openvswitch: Fix setting ipv6 fields causing hw csum failure
2022-03-02 11:41:07 +01:00
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
2022-03-23 09:12:06 +01:00
phonet: refcount leak in pep_sock_accep
2022-01-11 15:23:33 +01:00
rds: memory leak in __rds_conn_create()
2021-12-22 09:29:37 +01:00
rxrpc: Adjust retransmission backoff
2022-02-01 17:24:38 +01:00
net: sched: limit TC_ACT_REPEAT loops
2022-02-23 11:59:59 +01:00
sctp: fix the processing for INIT chunk
2022-03-19 13:40:13 +01:00
net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server
2022-03-08 19:07:47 +01:00
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
2021-11-17 09:48:48 +01:00
fsnotify: fix fsnotify hooks in pseudo filesystems
2022-02-01 17:24:34 +01:00
net: switchdev: do not propagate bridge updates across bridges
2021-10-27 09:54:24 +02:00
tipc: Fix end of loop tests for list_for_each_entry()
2022-03-02 11:41:06 +01:00
net/tls: Fix authentication failure in CCM mode
2021-12-08 09:01:14 +01:00
af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
2022-01-27 09:19:53 +01:00
vsock: remove vsock from connected table when connect is interrupted by a signal
2022-02-23 11:59:57 +01:00
nl80211: Update bss channel on channel switch for P2P_CLIENT
2022-03-19 13:40:17 +01:00
Revert "xsk: Do not sleep in poll() when need_wakeup set"
2021-12-22 09:29:40 +01:00
xfrm: fix tunnel model fragmentation behavior
2022-04-15 14:17:56 +02:00
ef388db2fe