Herbert Xu 5fa39f1603 net: Fix skb_set_peeked use-after-free bug ...

[ Upstream commit a0a2a66024 ]

The commit 738ac1ebb9 ("net: Clone
skb before setting peeked flag") introduced a use-after-free bug
in skb_recv_datagram.  This is because skb_set_peeked may create
a new skb and free the existing one.  As it stands the caller will
continue to use the old freed skb.

This patch fixes it by making skb_set_peeked return the new skb
(or the old one if unchanged).

Fixes: 738ac1ebb9 ("net: Clone skb before setting peeked flag")
Reported-by: Brenden Blanco <bblanco@plumgrid.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Brenden Blanco <bblanco@plumgrid.com>
Reviewed-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2015-10-01 12:07:36 +02:00

..

datagram.c

net: Fix skb_set_peeked use-after-free bug

2015-10-01 12:07:36 +02:00

dev_addr_lists.c

net/core: dev_mc_sync_multiple calls wrong helper

2013-05-31 16:56:56 -07:00

dev_ioctl.c

net: fix kernel deadlock with interface rename and netdev name retrieval.

2013-06-26 13:42:54 -07:00

dev.c

net: call rcu_read_lock early in process_backlog

2015-10-01 12:07:35 +02:00

drop_monitor.c

net: drop_monitor: fix the value of maxattr

2014-01-15 15:28:47 -08:00

dst.c

ipv4: fix dst race in sk_dst_get()

2014-07-28 08:00:04 -07:00

ethtool.c

vlan: restore ethtool ABI to control VLAN hardware acceleration

2013-06-17 17:09:35 -07:00

fib_rules.c

net: fix 'ip rule' iif/oif device rename

2014-03-06 21:30:03 -08:00

filter.c

filter: prevent nla extensions to peek beyond the end of the message

2014-05-30 21:52:15 -07:00

flow_dissector.c

net: flow_dissector: fail on evil iph->ihl

2013-11-20 12:27:46 -08:00

flow.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-04-01 13:36:50 -04:00

gen_estimator.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

gen_stats.c

gen_stats.c: Duplicate xstats buffer for later use

2015-03-18 13:22:26 +01:00

iovec.c

iovec: make sure the caller actually wants anything in memcpy_fromiovecend

2014-08-14 09:24:15 +08:00

link_watch.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2012-10-02 13:38:27 -07:00

Makefile

net: move procfs code to net/core/net-procfs.c

2013-02-19 00:51:10 -05:00

neighbour.c

neigh: recompute reachabletime before returning from neigh_periodic_work()

2014-03-23 21:38:10 -07:00

net_namespace.c

proc: Split the namespace stuff out into linux/proc_ns.h

2013-05-01 17:29:39 -04:00

net-procfs.c

net: Print functions in /proc/net/ptype without the offset.

2013-03-25 14:12:55 -04:00

net-sysfs.c

rps_dev_flow_table_release(): no need to delay vfree()

2013-05-06 11:06:51 -04:00

net-sysfs.h

xps: Add CONFIG_XPS

2010-11-28 18:24:14 -08:00

net-traces.c

net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules

2011-10-31 19:30:30 -04:00

netevent.c

net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules

2011-10-31 19:30:30 -04:00

netpoll.c

netpoll: fix the skb check in pkt_is_ns

2014-04-14 06:42:17 -07:00

netprio_cgroup.c

Revert "netprio_cgroup: make local table static"

2013-04-12 03:06:44 -04:00

pktgen.c

net: pktgen: fix race between pktgen_thread_worker() and kthread_stop()

2015-10-01 12:07:35 +02:00

request_sock.c

tcp: fix a panic on UP machines in reqsk_fastopen_remove

2013-01-14 18:10:05 -05:00

rtnetlink.c

rtnetlink: call ->dellink on failure when ->newlink exists

2015-03-18 13:22:26 +01:00

scm.c

net: Check the correct namespace when spoofing pid over SCM_RIGHTS

2013-09-26 17:18:05 -07:00

secure_seq.c

inetpeer: get rid of ip_id_count

2014-08-14 09:24:15 +08:00

skbuff.c

net: Correctly set segment mac_len in skb_segment().

2014-08-14 09:24:15 +08:00

sock_diag.c

net: Move the permission check in sock_diag_put_filterinfo to packet_diag_dump

2014-06-26 15:12:37 -04:00

sock.c

net: Add variants of capable for use on on sockets

2014-06-26 15:12:37 -04:00

stream.c

net: Fix the condition passed to sk_wait_event()

2010-10-03 20:41:32 -07:00

sysctl_net_core.c

net: sysctl_net_core: check SNDBUF and RCVBUF for min length

2015-03-26 15:00:55 +01:00

timestamping.c

net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules

2011-10-31 19:30:30 -04:00

user_dma.c

net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules

2011-10-31 19:30:30 -04:00

utils.c

net: core: let's use native isxdigit instead of custom

2013-03-27 12:48:32 -04:00