Lorenzo Colitti abe081915c Fix NULL pointer dereference in tcp_nuke_addr. ...

tcp_nuke addr only grabs the bottom half socket lock, but not the
userspace socket lock. This allows a userspace program to call
close() while the socket is running, which causes a NULL pointer
dereference in inet_put_port.

Bug: 23663111
Bug: 24072792
Change-Id: Iecb63af68c2db4764c74785153d1c9054f76b94f
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
(cherry picked from commit 74d66ee756afcc3269e4c1341f793c52be629af9)

2015-10-27 16:46:47 +08:00

..

9p

9p: forgetting to cancel request on interrupted zero-copy RPC

2015-08-03 09:29:47 -07:00

802

net/802/mrp: fix lockdep splat

2013-05-14 13:02:30 -07:00

8021q

8021q: fix a potential memory leak

2014-07-28 08:00:04 -07:00

appletalk

appletalk: Fix socket referencing in skb

2014-07-28 08:00:05 -07:00

atm

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

ax25

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

batman-adv

batman-adv: set up network coding packet handlers during module init

2013-11-20 12:27:47 -08:00

bluetooth

Merge branch 'linux-linaro-lsk' into linux-linaro-lsk-android

2014-09-18 10:49:35 -07:00

bridge

Merge branch 'linux-linaro-lsk-v3.10' into linux-linaro-lsk-v3.10-android

2015-10-14 13:41:57 -07:00

caif

Merge branch 'linaro-android-3.10-lsk' of git://android.git.linaro.org/kernel/linaro-android into linux-linaro-lsk-v3.10-android

2015-06-24 10:40:17 -07:00

can

can: add missing initialisations in CAN related skbuffs

2015-03-26 15:00:58 +01:00

ceph

crush: fix a bug in tree bucket decode

2015-08-03 09:29:46 -07:00

core

Merge tag 'v3.10.92'

2015-10-27 14:09:58 +08:00

dcb

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-06-26 15:12:37 -04:00

dccp

rk: revert 20f3d0b+v3.0.66 to v3.0

2013-11-08 21:34:05 +08:00

decnet

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-06-26 15:12:37 -04:00

dns_resolver

dns_resolver: Null-terminate the right string

2014-07-28 08:00:06 -07:00

dsa

dsa: fix freeing of sparse port allocation

2013-03-25 12:23:41 -04:00

ethernet

rk: revert 20f3d0b+v3.0.66 to v3.0

2013-11-08 21:34:05 +08:00

ieee802154

6lowpan: fix lockdep splats

2014-03-06 21:30:02 -08:00

ipv4

Fix NULL pointer dereference in tcp_nuke_addr.

2015-10-27 16:46:47 +08:00

ipv6

ipv6: sysctl to restrict candidate source addresses

2015-10-27 16:28:21 +08:00

ipx

ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg

2014-12-06 15:05:47 -08:00

irda

net: irda: fix wait_until_sent poll timeout

2015-03-18 13:22:31 +01:00

iucv

af_iucv: wrong mapping of sent and confirmed skbs

2014-06-30 20:09:40 -07:00

key

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

l2tp

l2tp: protect tunnel->del_work by ref_count

2015-10-27 09:44:47 +09:00

lapb

net/lapb: remove depends on CONFIG_EXPERIMENTAL

2013-01-11 11:40:01 -08:00

llc

net: llc: use correct size for sysctl timeout entries

2015-04-19 10:10:50 +02:00

mac80211

Merge tag 'lsk-v3.10-15.10-android'

2015-10-27 14:07:45 +08:00

mac802154

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-04-30 03:55:20 -04:00

netfilter

Merge tag 'v3.10.92'

2015-10-27 14:09:58 +08:00

netlabel

netlabel: improve domain mapping validation

2013-05-19 14:49:55 -07:00

netlink

netlink: don't hold mutex in rcu callback when releasing mmapd ring

2015-10-01 12:07:37 +02:00

netrom

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

nfc

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

openvswitch

openvswitch: fix panic with multiple vlan headers

2014-10-15 08:31:57 +02:00

packet

packet: avoid out of bounds read in round robin fanout

2015-07-10 10:40:20 -07:00

phonet

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-06-26 15:12:37 -04:00

rds

rds: fix an integer overflow test in rds_info_getsockopt()

2015-10-01 12:07:37 +02:00

rfkill

rfkill-wlan.c: solve mac addr all zero error, cause can't connect ap problem

2015-06-03 09:28:46 +08:00

rose

net: rose: restore old recvmsg behavior

2014-01-15 15:28:49 -08:00

rxrpc

rxrpc: bogus MSG_PEEK test in rxrpc_recvmsg()

2015-03-26 15:00:56 +01:00

sched

net_sched: invoke ->attach() after setting dev->qdisc

2015-06-22 16:55:51 -07:00

sctp

sctp: fix race on protocol/netns initialization

2015-10-01 12:07:38 +02:00

sunrpc

Merge branch 'linux-linaro-lsk-v3.10' into linux-linaro-lsk-v3.10-android

2015-08-14 09:55:00 -07:00

tipc

net/tipc: initialize security state for new connection socket

2015-10-01 12:07:35 +02:00

unix

Merge tag 'v3.10.92'

2015-10-27 14:09:58 +08:00

vmw_vsock

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

wimax

net: cleanup unsigned to unsigned int

2012-04-15 12:44:40 -04:00

wireless

Merge tag 'lsk-v3.10-15.09-android'

2015-09-28 19:16:34 +08:00

x25

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

xfrm

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-06-26 15:12:37 -04:00

activity_stats.c

rk: revert 20f3d0b+v3.0.66 to v3.0

2013-11-08 21:34:05 +08:00

compat.c

net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour

2015-03-26 15:00:56 +01:00

Kconfig

rk: revert 20f3d0b+v3.0.66 to v3.0

2013-11-08 21:34:05 +08:00

Makefile

rk: revert 20f3d0b+v3.0.66 to v3.0

2013-11-08 21:34:05 +08:00

nonet.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

socket.c

net: socket: Fix the wrong returns for recvmsg and sendmsg

2015-06-05 23:19:53 -07:00

sysctl_net.c

net: Update the sysctl permissions handler to test effective uid/gid

2013-10-13 16:08:34 -07:00