Mohamed Ghannam 7e2fb808d3 dccp: CVE-2017-8824: use-after-free in DCCP code ...

commit 69c64866ce upstream.

Whenever the sock object is in DCCP_CLOSED state,
dccp_disconnect() must free dccps_hc_tx_ccid and
dccps_hc_rx_ccid and set to NULL.

Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-02-17 13:21:13 +01:00

..

6lowpan

6lowpan: ndisc: no overreact if no short address is available

2016-09-19 20:19:34 +02:00

9p

net/9p: Switch to wait_event_killable()

2017-11-30 08:39:09 +00:00

802

…

8021q

8021q: fix a memory leak for VLAN 0 device

2018-01-17 09:38:52 +01:00

appletalk

appletalk: use IS_ENABLED() instead of checking for built-in or module

2016-09-10 21:19:10 -07:00

atm

lec: use IS_ENABLED() instead of checking for built-in or module

2016-09-10 21:19:10 -07:00

ax25

ax25: Fix segfault after sock connection timeout

2017-02-04 09:47:09 +01:00

batman-adv

batman-adv: Check for alloc errors when preparing TT local data

2016-12-02 10:46:59 +01:00

bluetooth

Bluetooth: Prevent stack info leak from the EFS element.

2018-01-17 09:38:56 +01:00

bridge

net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks

2018-01-02 20:35:12 +01:00

caif

net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx

2017-07-05 14:40:14 +02:00

can

can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once

2018-01-31 12:55:50 +01:00

ceph

libceph: don't WARN() if user tries to add invalid key

2017-11-30 08:39:03 +00:00

core

soreuseport: fix mem leak in reuseport_add_sock()

2018-02-13 12:35:57 +01:00

dcb

net: dcb: set error code on failures

2016-12-03 23:54:25 -05:00

dccp

dccp: CVE-2017-8824: use-after-free in DCCP code

2018-02-17 13:21:13 +01:00

decnet

decnet: always not take dst->__refcnt when inserting dst into hash table

2017-07-05 14:40:16 +02:00

dns_resolver

KEYS: Fix race between updating and finding a negative key

2017-10-27 10:38:11 +02:00

dsa

net: dsa: select NET_SWITCHDEV

2017-11-15 15:53:17 +01:00

ethernet

net: introduce device min_header_len

2017-02-18 15:11:43 +01:00

hsr

net/hsr: Remove unused but set variable

2016-10-18 10:28:18 -04:00

ieee802154

Revert "net: fix percpu memory leaks"

2017-09-20 08:19:55 +02:00

ipv4

tcp_bbr: fix pacing_gain to always be unity when using lt_bw

2018-02-13 12:35:56 +01:00

ipv6

ipv6: Fix SO_REUSEPORT UDP socket with implicit sk_ipv6only

2018-02-13 12:35:57 +01:00

ipx

ipx: call ipxitf_put() in ioctl error path

2017-05-25 15:44:41 +02:00

irda

irda: do not leak initialized list.dev to userspace

2017-08-30 10:21:42 +02:00

iucv

net/af_iucv: don't use paged skbs for TX on HiperSockets

2017-01-19 20:18:04 +01:00

kcm

fix kcm_clone()

2017-12-16 16:25:47 +01:00

key

af_key: fix buffer overread in parse_exthdrs()

2018-01-23 19:57:05 +01:00

l2tp

l2tp: cleanup l2tp_tunnel_delete calls

2017-12-20 10:07:31 +01:00

l3mdev

net: ipv6: Remove l3mdev_get_saddr6

2016-09-10 23:12:53 -07:00

lapb

net/lapb: tuse %*ph to dump buffers

2016-05-29 22:33:25 -07:00

llc

net/llc: avoid BUG_ON() in skb_orphan()

2017-02-26 11:10:50 +01:00

mac80211

mac80211: fix the update of path metric for RANN frame

2018-02-03 17:05:37 +01:00

mac802154

mac802154: use rate limited warnings for malformed frames

2016-09-19 20:19:34 +02:00

mpls

net: mpls: Fix nexthop alive tracking on down events

2017-12-20 10:07:25 +01:00

ncsi

net/ncsi: Improve HNCDSC AEN handler

2016-10-20 11:23:08 -04:00

netfilter

netfilter: xt_osf: Add missing permission checks

2018-01-31 12:55:52 +01:00

netlabel

netlabel: Implement CALIPSO config functions for SMACK.

2016-06-27 15:06:18 -04:00

netlink

netlink: Add netns check on taps

2018-01-02 20:35:10 +01:00

netrom

…

nfc

NFC: fix device-allocation error return

2017-11-30 08:39:07 +00:00

openvswitch

openvswitch: fix the incorrect flow action alloc size

2018-02-03 17:05:37 +01:00

packet

net/packet: fix a race in packet_bind() and packet_notifier()

2017-12-16 16:25:45 +01:00

phonet

…

qrtr

net: qrtr: Mark 'buf' as little endian

2017-12-09 22:01:51 +01:00

rds

RDS: null pointer dereference in rds_atomic_free_op

2018-01-17 09:38:53 +01:00

rfkill

…

rose

rose: limit sk_filter trim to payload

2016-07-13 11:53:40 -07:00

rxrpc

rxrpc: Ignore BUSY packets on old calls

2017-12-20 10:07:25 +01:00

sched

cls_u32: add missing RCU annotation.

2018-02-13 12:35:56 +01:00

sctp

gso: validate gso_type in GSO handlers

2018-01-31 12:55:55 +01:00

strparser

strparser: destroy workqueue on module exit

2017-03-22 12:43:33 +01:00

sunrpc

SUNRPC: Allow connect to return EHOSTUNREACH

2018-02-03 17:05:39 +01:00

switchdev

switchdev: Execute bridge ndos only for bridge ports

2016-10-19 10:58:04 -04:00

tipc

tipc: fix a memory leak in tipc_nl_node_get_link()

2018-01-31 12:55:55 +01:00

unix

net/unix: don't show information about sockets from other namespaces

2017-11-18 11:22:22 +01:00

vmw_vsock

vsock: cancel packets when failing to connect

2017-12-25 14:23:38 +01:00

wimax

…

wireless

nl80211: Sanitize array index in parse_txq_params

2018-02-13 12:36:00 +01:00

x25

net: x25: remove null checks on arrays calling_ae and called_ae

2016-09-09 18:13:30 -07:00

xfrm

xfrm: Copy policy family in clone_policy

2017-12-14 09:28:24 +01:00

compat.c

audit: log 32-bit socketcalls

2017-10-08 10:26:06 +02:00

Kconfig

strparser: Stream parser for messages

2016-08-17 19:36:23 -04:00

Makefile

strparser: Stream parser for messages

2016-08-17 19:36:23 -04:00

socket.c

bpf: introduce BPF_JIT_ALWAYS_ON config

2018-01-31 12:55:56 +01:00

sysctl_net.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

2016-10-06 09:52:23 -07:00