Tyler Hicks 64699d6d66 irda: Fix memory leak caused by repeated binds of irda socket ...

The irda_bind() function allocates memory for self->ias_obj without
checking to see if the socket is already bound. A userspace process
could repeatedly bind the socket, have each new object added into the
LM-IAS database, and lose the reference to the old object assigned to
the socket to exhaust memory resources. This patch errors out of the
bind operation when self->ias_obj is already assigned.

CVE-2018-6554

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reviewed-by: Seth Arnold <seth.arnold@canonical.com>
Reviewed-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-05-12 17:27:16 +09:00

..

ircomm

net: ircomm, cleanup TIOCGSERIAL

2016-06-25 08:56:30 -07:00

irlan

treewide: replace dev->trans_start update with helper

2016-05-04 14:16:49 -04:00

irnet

irda: replace current->state by set_current_state()

2015-02-23 17:21:11 -05:00

af_irda.c

irda: Fix memory leak caused by repeated binds of irda socket

2023-05-12 17:27:16 +09:00

discovery.c

irda: Convert IRDA_DEBUG to pr_debug

2014-11-12 13:56:41 -05:00

irda_device.c

irda: Convert IRDA_DEBUG to pr_debug

2014-11-12 13:56:41 -05:00

iriap_event.c

irda: Convert IRDA_DEBUG to pr_debug

2014-11-12 13:56:41 -05:00

iriap.c

net/irda: handle iriap_register_lsap() allocation failure

2016-08-13 15:09:07 -07:00

irias_object.c

irda: Convert IRDA_DEBUG to pr_debug

2014-11-12 13:56:41 -05:00

irlap_event.c

irda: Fix build failures after IRDA_DEBUG->pr_debug

2014-11-12 22:01:14 -05:00

irlap_frame.c

irda: Convert IRDA_DEBUG to pr_debug

2014-11-12 13:56:41 -05:00

irlap.c

irda: use msecs_to_jiffies for conversions

2015-01-30 18:08:25 -08:00

irlmp_event.c

irda: Fix build failures after IRDA_DEBUG->pr_debug

2014-11-12 22:01:14 -05:00

irlmp_frame.c

irda: Convert IRDA_DEBUG to pr_debug

2014-11-12 13:56:41 -05:00

irlmp.c

irda: precedence bug in irlmp_seq_hb_idx()

2015-10-21 07:48:26 -07:00

irmod.c

irda: Convert IRDA_DEBUG to pr_debug

2014-11-12 13:56:41 -05:00

irnetlink.c

irda: Convert IRDA_DEBUG to pr_debug

2014-11-12 13:56:41 -05:00

irproc.c

irda: irproc: Fix set-but-unused variables.

2011-04-17 16:59:50 -07:00

irqueue.c

irda: Fix lockdep annotations in hashbin_delete().

2017-02-26 11:10:51 +01:00

irsysctl.c

irda: Convert IRDA_DEBUG to pr_debug

2014-11-12 13:56:41 -05:00

irttp.c

irda: Convert function pointer arrays and uses to const

2014-12-10 15:33:16 -05:00

Kconfig

[S390] Kconfig: unwanted menus for s390.

2007-05-10 15:46:07 +02:00

Makefile

[IrDA]: Netlink layer.

2007-07-10 22:16:43 -07:00

parameters.c

irda: Convert function pointer arrays and uses to const

2014-12-10 15:33:16 -05:00

qos.c

irda: Convert function pointer arrays and uses to const

2014-12-10 15:33:16 -05:00

timer.c

irda: use msecs_to_jiffies for conversion to jiffies

2015-05-25 17:46:21 -04:00

wrapper.c

irda: Convert IRDA_DEBUG to pr_debug

2014-11-12 13:56:41 -05:00