Al Viro 8920e8f94c [PATCH] Fix 32bit sendmsg() flaw ...

When we copy 32bit ->msg_control contents to kernel, we walk the same
userland data twice without sanity checks on the second pass.

Second version of this patch: the original broke with 64-bit arches
running 32-bit-compat-mode executables doing sendmsg() syscalls with
unaligned CMSG data areas

Another thing is that we use kmalloc() to allocate and sock_kfree_s()
to free afterwards; less serious, but also needs fixing.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

2005-09-08 08:14:11 -07:00

..

bluetooth

[NET]: Store skb->timestamp as offset to a base timestamp

2005-08-29 15:58:24 -07:00

irda

[IRDA]: IrDA prototype fixes

2005-09-05 18:08:11 -07:00

sctp

[TCP]: Move the tcp sock states to net/tcp_states.h

2005-08-29 15:41:54 -07:00

tc_act

[PKT_SCHED]: Introduce simple actions.

2005-04-24 20:10:16 -07:00

act_api.h

[NET]: Kill skb->tc_classid

2005-08-29 15:31:18 -07:00

act_generic.h

[PKT_SCHED]: Fixup simple action define.

2005-05-19 12:42:39 -07:00

addrconf.h

[NET]: Fix sparse warnings

2005-08-29 16:01:32 -07:00

af_unix.h

[NET]: Fix sparse warnings

2005-08-29 16:01:32 -07:00

ah.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

arp.h

[NET]: Kill skb->real_dev

2005-08-29 15:32:25 -07:00

atmclip.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

ax25.h

[AX25]: Make ax2asc thread-proof

2005-09-06 15:49:39 -07:00

checksum.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

compat.h

[PATCH] Fix 32bit sendmsg() flaw

2005-09-08 08:14:11 -07:00

datalink.h

[NET]: Kill skb->real_dev

2005-08-29 15:32:25 -07:00

dn_dev.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

dn_fib.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

dn_neigh.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

dn_nsp.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

dn_route.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

dn.h

[TCP]: Move the tcp sock states to net/tcp_states.h

2005-08-29 15:41:54 -07:00

dsfield.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

dst.h

[NET]: Shave sizeof(ptr) bytes off dst_entry

2005-04-19 20:46:37 -07:00

esp.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

flow.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

gen_stats.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

icmp.h

[NET]: Fix sparse warnings

2005-08-29 16:01:32 -07:00

ieee80211_crypt.h

[NET] ieee80211 subsystem

2005-05-12 22:48:20 -04:00

ieee80211.h

[PATCH] ieee80211: Fix debug comments ipw->ieee80211

2005-08-28 19:23:07 -04:00

if_inet6.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

inet6_hashtables.h

[INET6_HASHTABLES]: Move inet6_lookup functions to net/ipv6/inet6_hashtables.c

2005-08-29 15:57:29 -07:00

inet_common.h

[INET]: Move the TCP hashtable functions/structs to inet_hashtables.[ch]

2005-08-29 15:38:39 -07:00

inet_connection_sock.h

[INET]: compile errors when DEBUG is defined

2005-08-29 22:51:28 -07:00

inet_ecn.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

inet_hashtables.h

[ICSK]: Generalise tcp_listen_{start,stop}

2005-08-29 15:49:24 -07:00

inet_timewait_sock.h

[TIMEWAIT]: Move inet_timewait_death_row routines to net/ipv4/inet_timewait_sock.c

2005-08-29 15:55:58 -07:00

inetpeer.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

ip6_checksum.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

ip6_fib.h

[IPV6]: V6 route events reported with wrong netlink PID and seq number

2005-06-21 13:51:04 -07:00

ip6_route.h

[TCP]: Move the tcp sock states to net/tcp_states.h

2005-08-29 15:41:54 -07:00

ip6_tunnel.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

ip_fib.h

[NET]: Fix sparse warnings

2005-08-29 16:01:32 -07:00

ip_mp_alg.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

ip_vs.h

[IPVS]: "extern inline" -> "static inline"

2005-09-01 17:40:26 -07:00

ip.h

[IP]: Introduce ip_options_get_from_user

2005-08-29 16:01:39 -07:00

ipcomp.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

ipconfig.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

ipip.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

ipv6.h

[NET]: Fix sparse warnings

2005-08-29 16:01:32 -07:00

ipx.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

iw_handler.h

[PATCH] WE-19 for kernel 2.6.13

2005-09-06 22:40:24 -04:00

lapb.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

llc_c_ac.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

llc_c_ev.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

llc_c_st.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

llc_conn.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

llc_if.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

llc_pdu.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

llc_s_ac.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

llc_s_ev.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

llc_s_st.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

llc_sap.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

llc.h

[NET]: Kill skb->real_dev

2005-08-29 15:32:25 -07:00

ndisc.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

neighbour.h

[NET]: Store skb->timestamp as offset to a base timestamp

2005-08-29 15:58:24 -07:00

netrom.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

p8022.h

[NET]: Fix sparse warnings

2005-08-29 16:01:32 -07:00

pkt_act.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

pkt_cls.h

[NET]: Remove explicit initializations of skb->input_dev

2005-08-29 15:33:26 -07:00

pkt_sched.h

[PKT_SCHED]: Cleanup qdisc creation and alignment macros

2005-07-05 14:15:09 -07:00

protocol.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

psnap.h

[NET]: Kill skb->real_dev

2005-08-29 15:32:25 -07:00

raw.h

[NET]: Fix sparse warnings

2005-08-29 16:01:32 -07:00

rawv6.h

[IPV4/6]: Check if packet was actually delivered to a raw socket to decide whether to send an ICMP unreachable

2005-08-29 15:37:22 -07:00

request_sock.h

[ICSK]: Move generalised functions from tcp to inet_connection_sock

2005-08-29 15:49:50 -07:00

rose.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

route.h

[NET]: Fix sparse warnings

2005-08-29 16:01:32 -07:00

sch_generic.h

[PKT_SCHED]: Cleanup qdisc creation and alignment macros

2005-07-05 14:15:09 -07:00

scm.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

slhc_vj.h

[NET]: Remove __ARGS from include/net/slhc_vj.h

2005-07-05 15:12:04 -07:00

snmp.h

[PATCH] smp_processor_id() cleanup

2005-06-21 18:46:13 -07:00

sock.h

[NET]: Do not protect sysctl_optmem_max with CONFIG_SYSCTL

2005-09-05 18:14:11 -07:00

syncppp.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

tcp_ecn.h

[NET]: Introduce inet_connection_sock

2005-08-29 15:43:19 -07:00

tcp_states.h

[TCP]: Move the tcp sock states to net/tcp_states.h

2005-08-29 15:41:54 -07:00

tcp.h

[TCP]: Keep TSO enabled even during loss events.

2005-09-01 22:47:01 -07:00

transp_v6.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

udp.h

[NET]: Fix sparse warnings

2005-08-29 16:01:32 -07:00

x25.h

[NET]: Kill skb->real_dev

2005-08-29 15:32:25 -07:00

x25device.h

[NET]: Remove explicit initializations of skb->input_dev

2005-08-29 15:33:26 -07:00

xfrm.h

[IPV4]: possible cleanups

2005-08-29 15:33:20 -07:00