linux-stable.git/drivers/connector, branch v3.12.73

connector: bump skb->users before callback invocation

2016-01-28T08:41:33+00:00

[ Upstream commit 55285bf09427c5abf43ee1d54e892f352092b1f1 ]

Dmitry reports memleak with syskaller program.
Problem is that connector bumps skb usecount but might not invoke callback.

So move skb_get to where we invoke the callback.

Reported-by: Dmitry Vyukov 
Signed-off-by: Florian Westphal 
Signed-off-by: David S. Miller 
Signed-off-by: Jiri Slaby

cn: verify msg->len before making callback

2015-05-26T14:26:55+00:00

commit a30cfa475d1a26c18f1998ba1e034a4e2ab4c7a8 upstream.

The struct cn_msg len field comes from userspace and needs to be
validated.  More logical to do so here where the cn_msg pointer is
pulled out of the sk_buff than the callback which is passed cn_msg *
and might assume no validation is needed.

Reported-by: Dan Carpenter 
Acked-by: Evgeniy Polyakov 
Signed-off-by: David Fries 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Jiri Slaby

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-06-23T08:27:57+00:00

[ Upstream commit 90f62cf30a78721641e08737bda787552428061e ]

It is possible by passing a netlink socket to a more privileged
executable and then to fool that executable into writing to the socket
data that happens to be valid netlink message to do something that
privileged executable did not intend to do.

To keep this from happening replace bare capable and ns_capable calls
with netlink_capable, netlink_net_calls and netlink_ns_capable calls.
Which act the same as the previous calls except they verify that the
opener of the socket had the desired permissions as well.

Reported-by: Andy Lutomirski 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller 
Signed-off-by: Jiri Slaby

connector: improved unaligned access error fix

2013-12-08T15:29:12+00:00

[ Upstream commit 1ca1a4cf59ea343a1a70084fe7cc96f37f3cf5b1 ]

In af3e095a1fb4, Erik Jacobsen fixed one type of unaligned access
bug for ia64 by converting a 64-bit write to use put_unaligned().
Unfortunately, since gcc will convert a short memset() to a series
of appropriately-aligned stores, the problem is now visible again
on tilegx, where the memset that zeros out proc_event is converted
to three 64-bit stores, causing an unaligned access panic.

A better fix for the original problem is to ensure that proc_event
is aligned to 8 bytes here.  We can do that relatively easily by
arranging to start the struct cn_msg aligned to 8 bytes and then
offset by 4 bytes.  Doing so means that the immediately following
proc_event structure is then correctly aligned to 8 bytes.

The result is that the memset() stores are now aligned, and as an
added benefit, we can remove the put_unaligned() calls in the code.

Signed-off-by: Chris Metcalf 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

connector: use 'size' everywhere in cn_netlink_send()

2013-10-02T20:03:50+00:00

We calculated the size for the netlink message buffer as size. Use size
in the memcpy() call as well instead of recalculating it.

Signed-off-by: Mathias Krause 
Signed-off-by: David S. Miller

connector: use nlmsg_len() to check message length

2013-10-02T20:03:50+00:00

The current code tests the length of the whole netlink message to be
at least as long to fit a cn_msg. This is wrong as nlmsg_len includes
the length of the netlink message header. Use nlmsg_len() instead to
fix this "off-by-NLMSG_HDRLEN" size check.

Cc: stable@vger.kernel.org  # v2.6.14+
Signed-off-by: Mathias Krause 
Signed-off-by: David S. Miller

proc connector: fix info leaks

2013-10-02T20:03:50+00:00

Initialize event_data for all possible message types to prevent leaking
kernel stack contents to userland (up to 20 bytes). Also set the flags
member of the connector message to 0 to prevent leaking two more stack
bytes this way.

Cc: stable@vger.kernel.org  # v2.6.15+
Signed-off-by: Mathias Krause 
Signed-off-by: David S. Miller

connector: replace obsolete NLMSG_* with type safe nlmsg_*

2013-03-28T18:27:44+00:00

Signed-off-by: Hong Zhiguo 
Acked-by: Thomas Graf 
Signed-off-by: David S. Miller

connector: Added coredumping event to the process connector

2013-03-20T17:23:21+00:00

Process connector can now also detect coredumping events.

Main aim of patch is get notified at start of coredumping, instead of
having to wait for it to finish and then being notified through EXIT
event.

Could be used for instance by process-managers that want to get
notified as soon as possible about process failures, and not
necessarily beeing notified after coredump, which could be in the
order of minutes depending on size of coredump, piping and so on.

Signed-off-by: Jesper Derehag 
Signed-off-by: David S. Miller

proc connector: reject unprivileged listener bumps

2013-02-27T18:08:35+00:00

While PROC_CN_MCAST_LISTEN/IGNORE is entirely advisory, it was possible
for an unprivileged user to turn off notifications for all listeners by
sending PROC_CN_MCAST_IGNORE. Instead, require the same privileges as
required for a multicast bind.

Signed-off-by: Kees Cook 
Cc: Evgeniy Polyakov 
Cc: Matt Helsley 
Cc: stable@vger.kernel.org
Acked-by: Evgeniy Polyakov 
Acked-by: Matt Helsley 
Signed-off-by: David S. Miller