Jason Wang 325b4161ba net: sock: validate data_len before allocating skb in sock_alloc_send_pskb() ...

[ Upstream commit cc9b17ad29 ]

We need to validate the number of pages consumed by data_len, otherwise frags
array could be overflowed by userspace. So this patch validate data_len and
return -EMSGSIZE when data_len may occupies more frags than MAX_SKB_FRAGS.

Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2012-07-16 08:47:36 -07:00

..

9p

net/9p: Fix kernel crash with msize 512K

2011-10-03 11:40:22 -07:00

802

snap: remove one synchronize_net()

2011-05-23 16:29:24 -04:00

8021q

Revert "net: maintain namespace isolation between vlan and real device"

2012-06-10 00:33:03 +09:00

appletalk

appletalk: Fix OOPS in atalk_release().

2011-03-31 18:59:10 -07:00

atm

net: fix NULL dereferences in check_peer_redir()

2012-02-13 11:06:13 -08:00

ax25

net ax25: Reorder ax25_exit to remove races.

2012-04-27 09:51:21 -07:00

batman-adv

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

2011-05-20 13:43:21 -07:00

bluetooth

Bluetooth: hci_core: fix NULL-pointer dereference at unregister

2012-04-22 16:21:42 -07:00

bridge

bridge: Do not send queries on multicast group leaves

2012-04-27 09:51:18 -07:00

caif

net caif: Register properly as a pernet subsystem.

2012-02-03 09:19:03 -08:00

can

can bcm: fix incomplete tx_setup fix

2011-11-11 09:36:45 -08:00

ceph

ceph: fix file mode calculation

2011-07-19 11:25:04 -07:00

core

net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()

2012-07-16 08:47:36 -07:00

dcb

net: dcbnl: Update copyright dates

2011-03-14 17:02:42 -07:00

dccp

net: Compute protocol sequence numbers and fragment IDs using MD5.

2011-08-15 18:31:35 -07:00

decnet

net: fix NULL dereferences in check_peer_redir()

2012-02-13 11:06:13 -08:00

dns_resolver

KEYS: Improve /proc/keys

2011-03-17 11:59:32 +11:00

dsa

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2011-05-05 14:59:02 -07:00

econet

econet: Fix set-but-unused variable.

2011-04-17 00:15:22 -07:00

ethernet

net: add IFF_SKB_TX_SHARED flag to priv_flags

2011-08-15 18:31:38 -07:00

ieee802154

ieee802154: Don't leak memory in ieee802154_nl_fill_phy

2011-06-13 18:03:22 -04:00

ipv4

xfrm: take net hdr len into account for esp payload size calculation

2012-06-10 00:33:03 +09:00

ipv6

xfrm: take net hdr len into account for esp payload size calculation

2012-06-10 00:33:03 +09:00

ipx

ipx: fix ipx_release()

2011-03-21 18:16:39 -07:00

irda

irda: iriap: Use seperate lockdep class for irias_objects->hb_spinlock

2011-06-06 17:00:35 -07:00

iucv

[S390] irq: merge irq.c and s390_ext.c

2011-05-26 09:48:24 +02:00

key

net: convert %p usage to %pK

2011-05-24 01:13:12 -04:00

l2tp

l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case

2012-06-10 00:33:02 +09:00

lapb

Net: lapb: Makefile: Remove deprecated kbuild goal definitions

2010-11-22 08:16:14 -08:00

llc

llc: llc_cmsg_rcv was getting called after sk_eat_skb.

2012-01-06 14:14:06 -08:00

mac80211

mac80211: clean up remain-on-channel on interface stop

2012-06-17 11:23:10 -07:00

netfilter

ipvs: fix matching of fwmark templates during scheduling

2012-02-29 16:34:31 -08:00

netlabel

Remove prefetch() from <linux/skbuff.h> and "netlabel_addrlist.h"

2011-05-22 21:43:41 -07:00

netlink

netlink: fix races after skb queueing

2012-04-27 09:51:19 -07:00

netrom

NET: AX.25, NETROM, ROSE: Remove SOCK_DEBUG calls

2011-04-14 00:20:07 -07:00

packet

make PACKET_STATISTICS getsockopt report consistently between ring and non-ring

2011-11-11 09:36:29 -08:00

phonet

phonet: Check input from user before allocating

2012-04-27 09:51:19 -07:00

rds

Remove printk from rds_sendmsg

2012-04-02 09:27:21 -07:00

rfkill

net: rfkill: add generic gpio rfkill driver

2011-05-19 13:53:54 -04:00

rose

rose_dev: fix memcpy-bug in rose_set_mac_address

2012-04-13 08:14:05 -07:00

rxrpc

rxrpc: Fix set but unused variable 'usage' in rxrpc_get_transport()

2011-05-19 18:51:50 -04:00

sched

netem: fix possible skb leak

2012-05-21 09:39:59 -07:00

sctp

sctp: check cached dst before using it

2012-06-10 00:33:03 +09:00

sunrpc

NFSv4.1: Fix a request leak on the back channel

2012-06-22 11:34:13 -07:00

tipc

tipc: Revise timings used when sending link request messages

2011-05-10 16:04:02 -04:00

unix

net: convert %p usage to %pK

2011-05-24 01:13:12 -04:00

wanrouter

Fix common misspellings

2011-03-31 11:26:23 -03:00

wimax

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

2010-05-20 21:04:44 -07:00

wireless

cfg80211: fix interface combinations check

2012-06-17 11:23:10 -07:00

x25

x25: Prevent skb overreads when checking call user data

2011-10-25 07:10:17 +02:00

xfrm

ipv6: fix incorrect ipsec fragment

2012-06-10 00:33:02 +09:00

compat.c

net: Add sendmmsg socket system call

2011-05-05 11:10:14 -07:00

Kconfig

bpf: depends on MODULES

2011-04-29 10:20:53 -07:00

Makefile

net: Enter net/ipv6/ even if CONFIG_IPV6=n

2011-03-07 12:50:52 -08:00

nonet.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

socket.c

tcp: allow splice() to build full TSO packets

2012-04-27 09:51:18 -07:00

sysctl_net.c

net: Remove unnecessary returns from void function()s

2010-05-17 23:23:14 -07:00

TUNABLE

…