John Stultz b07eec3450 ANDROID: xt_qtaguid: Fix panic caused by processing non-full socket. ...

In an issue very similar to 4e461c777e3 (xt_qtaguid: Fix panic
caused by synack processing), we were seeing panics on occasion
in testing.

In this case, it was the same issue, but caused by a different
call path, as the sk being returned from qtaguid_find_sk() was
not a full socket. Resulting in the sk->sk_socket deref to fail.

This patch adds an extra check to ensure the sk being retuned
is a full socket, and if not it returns NULL.

Reported-by: Milosz Wasilewski <milosz.wasilewski@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>

2017-07-17 10:27:40 +05:30

..

6lowpan

6lowpan: Don't set IFF_NO_QUEUE

2017-04-12 22:02:40 +02:00

9p

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

802

net: introduce __skb_put_[zero, data, u8]

2017-06-20 13:30:14 -04:00

8021q

net: add netlink_ext_ack argument to rtnl_link_ops.validate

2017-06-26 23:13:22 -04:00

appletalk

networking: make skb_push & __skb_push return void pointers

2017-06-16 11:48:40 -04:00

atm

net, atm: convert eg_cache_entry.use from atomic_t to refcount_t

2017-07-04 22:35:16 +01:00

ax25

net, ax25: convert ax25_cb.refcount from atomic_t to refcount_t

2017-07-04 22:35:19 +01:00

batman-adv

networking: make skb_put & friends return void pointers

2017-06-16 11:48:39 -04:00

bluetooth

ANDROID: Paranoid network.

2017-07-17 10:27:40 +05:30

bpf

bpf: Align packet data properly in program testing framework.

2017-05-02 11:46:28 -04:00

bridge

ANDROID: bridge: Have tx_bytes count headers like rx_bytes.

2017-07-17 10:27:40 +05:30

caif

net: convert sock.sk_wmem_alloc from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

can

networking: introduce and use skb_put_data()

2017-06-16 11:48:37 -04:00

ceph

Add wait_for_random_bytes() and get_random_*_wait() functions so that

2017-07-15 12:44:02 -07:00

core

Add wait_for_random_bytes() and get_random_*_wait() functions so that

2017-07-15 12:44:02 -07:00

dcb

dcb: enforce minimum length on IEEE_APPS attribute

2017-05-21 13:42:33 -04:00

dccp

net: convert sk_buff.users from atomic_t to refcount_t

2017-07-01 07:39:07 -07:00

decnet

net, decnet: convert dn_fib_info.fib_clntref from atomic_t to refcount_t

2017-07-04 22:35:15 +01:00

dns_resolver

Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-03-03 10:16:38 -08:00

dsa

net: manual clean code which call skb_put_[data:zero]

2017-06-20 13:30:15 -04:00

ethernet

networking: make skb_push & __skb_push return void pointers

2017-06-16 11:48:40 -04:00

hsr

net: add netlink_ext_ack argument to rtnl_link_ops.newlink

2017-06-26 23:13:21 -04:00

ieee802154

net: add netlink_ext_ack argument to rtnl_link_ops.validate

2017-06-26 23:13:22 -04:00

ife

…

ipv4

ANDROID: tcp: fix tcp_default_init_rwnd() for 4.1

2017-07-17 10:27:40 +05:30

ipv6

ANDROID: net: xt_socket/nf_socket: fix refcount underflow and crash

2017-07-17 10:27:40 +05:30

ipx

net, ipx: convert ipx_route.refcnt from atomic_t to refcount_t

2017-07-04 22:35:17 +01:00

irda

Merge branch 'work.memdup_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-05 16:05:24 -07:00

iucv

iucv: Convert sk_wmem_alloc accesses to refcount_t.

2017-07-03 02:31:22 -07:00

kcm

net: convert sock.sk_wmem_alloc from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

key

net, xfrm: convert xfrm_policy.refcnt from atomic_t to refcount_t

2017-07-04 22:35:18 +01:00

l2tp

net, l2tp: convert l2tp_session.ref_count from atomic_t to refcount_t

2017-07-04 22:35:15 +01:00

l3mdev

…

lapb

net, lapb: convert lapb_cb.refcnt from atomic_t to refcount_t

2017-07-04 22:35:16 +01:00

llc

net, llc: convert llc_sap.refcnt from atomic_t to refcount_t

2017-07-04 22:35:15 +01:00

mac80211

net: manual clean code which call skb_put_[data:zero]

2017-06-20 13:30:15 -04:00

mac802154

net: Fix inconsistent teardown and release of private netdev state.

2017-06-07 15:53:24 -04:00

mpls

mpls: fix uninitialized in_label var warning in mpls_getroute

2017-07-08 11:26:41 +01:00

ncsi

networking: make skb_push & __skb_push return void pointers

2017-06-16 11:48:40 -04:00

netfilter

ANDROID: xt_qtaguid: Fix panic caused by processing non-full socket.

2017-07-17 10:27:40 +05:30

netlabel

netlink: pass extended ACK struct to parsing functions

2017-04-13 13:58:22 -04:00

netlink

net: convert sock.sk_refcnt from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

netrom

net, netrom: convert nr_node.refcount from atomic_t to refcount_t

2017-07-04 22:35:17 +01:00

nfc

NFC: Add sockaddr length checks before accessing sa_family in bind handlers

2017-06-23 00:38:31 +02:00

openvswitch

openvswitch: fix mis-ordered comment lines for ovs_skb_cb

2017-07-03 05:54:00 -07:00

packet

net: convert packet_fanout.sk_ref from atomic_t to refcount_t

2017-07-01 07:39:09 -07:00

phonet

net: convert sock.sk_refcnt from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

psample

networking: make skb_put & friends return void pointers

2017-06-16 11:48:39 -04:00

qrtr

networking: make skb_put & friends return void pointers

2017-06-16 11:48:39 -04:00

rds

rds: tcp: use sock_create_lite() to create the accept socket

2017-07-08 11:16:16 +01:00

rfkill

ANDROID: rfkill: Introduce CONFIG_RFKILL_PM and use instead of CONFIG_PM to power down

2017-07-17 10:27:40 +05:30

rose

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

rxrpc

net: convert sock.sk_refcnt from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

sched

mm, tree wide: replace __GFP_REPEAT by __GFP_RETRY_MAYFAIL with more useful semantic

2017-07-12 16:26:03 -07:00

sctp

sctp: set the value of flowi6_oif to sk_bound_dev_if to make sctp_v6_get_dst to find the correct route entry.

2017-07-06 11:39:54 +01:00

smc

net/smc: Add warning about remote memory exposure

2017-05-16 14:49:43 -04:00

strparser

strparser: destroy workqueue on module exit

2017-03-03 20:43:26 -08:00

sunrpc

NFS client updates for Linux 4.13

2017-07-13 14:35:37 -07:00

switchdev

net: switchdev: Change notifier chain to be atomic

2017-06-08 14:16:24 -04:00

tipc

net: convert sock.sk_refcnt from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

tls

TLS: Fix length check in do_tls_getsockopt_tx()

2017-07-06 10:58:19 +01:00

unix

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2017-07-05 12:31:59 -07:00

vmw_vsock

net: manual clean code which call skb_put_[data:zero]

2017-06-20 13:30:15 -04:00

wimax

…

wireless

ANDROID: net: wireless: Decrease scan entry expiration to avoid stall results

2017-07-17 10:27:40 +05:30

x25

net, x25: convert x25_neigh.refcnt from atomic_t to refcount_t

2017-07-04 22:35:18 +01:00

xfrm

net, xfrm: convert sec_path.refcnt from atomic_t to refcount_t

2017-07-04 22:35:18 +01:00

compat.c

get_compat_bpf_fprog(): don't copyin field-by-field

2017-07-04 13:14:34 -04:00

Kconfig

ANDROID: Paranoid network.

2017-07-17 10:27:40 +05:30

Makefile

tls: kernel TLS support

2017-06-15 12:12:40 -04:00

socket.c

Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 11:06:17 -07:00

sysctl_net.c

sysctl: Remove dead register_sysctl_root

2017-04-16 23:42:49 -05:00