Neal Cardwell 5e1f54201c inet_diag: validate port comparison byte code to prevent unsafe reads ...

Add logic to verify that a port comparison byte code operation
actually has the second inet_diag_bc_op from which we read the port
for such operations.

Previously the code blindly referenced op[1] without first checking
whether a second inet_diag_bc_op struct could fit there. So a
malicious user could make the kernel read 4 bytes beyond the end of
the bytecode array by claiming to have a whole port comparison byte
code (2 inet_diag_bc_op structs) when in fact the bytecode was not
long enough to hold both.

Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2012-12-09 19:00:48 -05:00

..

netfilter

netfilter: nf_nat: don't check for port change on ICMP tuples

2012-10-28 22:43:34 +01:00

af_inet.c

ipv4: Don't add TCP-code in inet_sock_destruct

2012-09-20 17:12:27 -04:00

ah4.c

ipv4: Add redirect support to all protocol icmp error handlers.

2012-07-11 21:27:49 -07:00

arp.c

ipv4/route: arg delay is useless in rt_cache_flush()

2012-09-18 15:44:34 -04:00

cipso_ipv4.c

cipso: don't follow a NULL pointer when setsockopt() is called

2012-07-18 09:01:12 -07:00

datagram.c

ipv4: Lock socket and use cork flow in ip4_datagram_connect().

2011-05-08 13:48:57 -07:00

devinet.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-09-28 14:40:49 -04:00

esp4.c

ipv4: Add redirect support to all protocol icmp error handlers.

2012-07-11 21:27:49 -07:00

fib_frontend.c

ipv4: fix sending of redirects

2012-10-08 17:42:35 -04:00

fib_lookup.h

…

fib_rules.c

sections: fix section conflicts in net

2012-10-06 03:04:45 +09:00

fib_semantics.c

ipv4: make sure nh_pcpu_rth_output is always allocated

2012-10-08 17:42:35 -04:00

fib_trie.c

ipv4/route: arg delay is useless in rt_cache_flush()

2012-09-18 15:44:34 -04:00

gre.c

net: ipv4: Standardize prefixes for message logging

2012-03-12 17:05:21 -07:00

icmp.c

ipv4: avoid passing NULL to inet_putpeer() in icmpv4_xrlim_allow()

2012-11-26 17:24:41 -05:00

igmp.c

igmp: export symbol ip_mc_leave_group

2012-10-01 18:39:44 -04:00

inet_connection_sock.c

ipv4: introduce rt_uses_gateway

2012-10-08 17:42:36 -04:00

inet_diag.c

inet_diag: validate port comparison byte code to prevent unsafe reads

2012-12-09 19:00:48 -05:00

inet_fragment.c

ipv6: unify fragment thresh handling code

2012-09-19 17:23:28 -04:00

inet_hashtables.c

ipv4: fix checkpatch errors

2012-04-15 12:37:19 -04:00

inet_lro.c

net: add skb frag size accessors

2011-10-19 03:10:46 -04:00

inet_timewait_sock.c

net: ipv4 and ipv6: Convert printk(KERN_DEBUG to pr_debug

2012-05-16 01:01:03 -04:00

inetpeer.c

Merge branch 'for-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq

2012-10-02 09:54:49 -07:00

ip_forward.c

ipv4: introduce rt_uses_gateway

2012-10-08 17:42:36 -04:00

ip_fragment.c

ipv6: unify fragment thresh handling code

2012-09-19 17:23:28 -04:00

ip_gre.c

gre: fix sparse warning

2012-10-01 17:35:31 -04:00

ip_input.c

net: TCP early demux cleanup

2012-07-30 14:53:21 -07:00

ip_options.c

ipv4: optimize fib_compute_spec_dst call in ip_options_echo

2012-07-19 08:30:49 -07:00

ip_output.c

ipv4: introduce rt_uses_gateway

2012-10-08 17:42:36 -04:00

ip_sockglue.c

ipv4: avoid undefined behavior in do_ip_setsockopt()

2012-11-11 17:53:13 -05:00

ip_vti.c

ipv4/ip_vti.c: VTI fix post-decryption forwarding

2012-11-14 21:40:21 -05:00

ipcomp.c

ipv4: Add redirect support to all protocol icmp error handlers.

2012-07-11 21:27:49 -07:00

ipconfig.c

ipconfig: fix trivial build error

2012-09-25 13:22:30 -04:00

ipip.c

tunnel: drop packet if ECN present with not-ECT

2012-09-27 18:12:37 -04:00

ipmr.c

net: ipmr: limit MRT_TABLE identifiers

2012-11-26 17:36:59 -05:00

Kconfig

net/ipv4: VTI support new module for ip_vti.

2012-07-18 09:36:12 -07:00

Makefile

memcg: rename config variables

2012-07-31 18:42:43 -07:00

netfilter.c

netfilter: properly annotate ipv4_netfilter_{init,fini}()

2012-09-03 13:56:04 +02:00

ping.c

userns: Use kgids for sysctl_ping_group_range

2012-08-14 21:49:10 -07:00

proc.c

tcp: TCP Fast Open Server - header & support functions

2012-08-31 20:02:18 -04:00

protocol.c

inet: Sanitize inet{,6} protocol demux.

2012-06-19 18:56:21 -07:00

raw.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

2012-10-02 11:11:09 -07:00

route.c

ipv4: do not cache looped multicasts

2012-11-22 16:06:49 -05:00

syncookies.c

tcp: TCP Fast Open Server - support TFO listeners

2012-08-31 20:02:19 -04:00

sysctl_net_ipv4.c

tcp: sysctl interface leaks 16 bytes of kernel memory

2012-10-11 15:12:33 -04:00

tcp_bic.c

tcp: fix undo after RTO for BIC

2012-01-20 14:17:26 -05:00

tcp_cong.c

tcp: Apply device TSO segment limit earlier

2012-08-02 00:19:17 -07:00

tcp_cubic.c

tcp: fix undo after RTO for CUBIC

2012-01-20 14:17:26 -05:00

tcp_diag.c

inet_diag: Rename inet_diag_req into inet_diag_req_v2

2012-01-11 12:56:06 -08:00

tcp_fastopen.c

tcp: TCP Fast Open Server - header & support functions

2012-08-31 20:02:18 -04:00

tcp_highspeed.c

…

tcp_htcp.c

…

tcp_hybla.c

tcp: bool conversions

2012-05-17 14:59:59 -04:00

tcp_illinois.c

net: fix divide by zero in tcp algorithm illinois

2012-11-01 11:55:59 -04:00

tcp_input.c

tcp: bug fix Fast Open client retransmission

2012-12-07 14:39:28 -05:00

tcp_ipv4.c

tcp: add SYN/data info to TCP_INFO

2012-10-22 15:16:06 -04:00

tcp_lp.c

…

tcp_memcontrol.c

memcg: decrement static keys at real destroy time

2012-05-29 16:22:28 -07:00

tcp_metrics.c

tcp: handle tcp_net_metrics_init() order-5 memory allocation failures

2012-11-16 13:36:27 -05:00

tcp_minisocks.c

tcp: add SYN/data info to TCP_INFO

2012-10-22 15:16:06 -04:00

tcp_output.c

tcp: bug fix Fast Open client retransmission

2012-12-07 14:39:28 -05:00

tcp_probe.c

net: cleanup unsigned to unsigned int

2012-04-15 12:44:40 -04:00

tcp_scalable.c

…

tcp_timer.c

tcp: Reject invalid ack_seq to Fast Open sockets

2012-10-23 02:42:56 -04:00

tcp_vegas.c

…

tcp_vegas.h

…

tcp_veno.c

…

tcp_westwood.c

…

tcp_yeah.c

…

tcp.c

tcp: fix crashes in do_tcp_sendpages()

2012-12-01 20:39:16 -05:00

tunnel4.c

net: Convert printks to pr_<level>

2012-03-11 23:42:51 -07:00

udp_diag.c

netlink: Rename pid to portid to avoid confusion

2012-09-10 15:30:41 -04:00

udp_impl.h

ipv4: fix checkpatch errors

2012-04-15 12:37:19 -04:00

udp.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

2012-10-02 11:11:09 -07:00

udplite.c

net: ipv4: Standardize prefixes for message logging

2012-03-12 17:05:21 -07:00

xfrm4_input.c

ipv4: Fix input route performance regression.

2012-07-26 15:50:39 -07:00

xfrm4_mode_beet.c

ipsec: be careful of non existing mac headers

2012-02-23 16:50:45 -05:00

xfrm4_mode_transport.c

…

xfrm4_mode_tunnel.c

net/ipv4: VTI support rx-path hook in xfrm4_mode_tunnel.

2012-07-18 09:36:12 -07:00

xfrm4_output.c

xfrm4: Don't call icmp_send on local error

2011-07-01 17:33:19 -07:00

xfrm4_policy.c

xfrm: Fix the gc threshold value for ipv4

2012-11-13 09:15:07 +01:00

xfrm4_state.c

net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules

2011-10-31 19:30:30 -04:00

xfrm4_tunnel.c

net: ipv4: Standardize prefixes for message logging

2012-03-12 17:05:21 -07:00