linux-stable.git/net/packet, branch linux-2.6.33.y

af_packet: prevent information leak

2011-07-13T03:31:27+00:00

[ Upstream commit 13fcb7bd322164c67926ffe272846d4860196dc6 ]

In 2.6.27, commit 393e52e33c6c2 (packet: deliver VLAN TCI to userspace)
added a small information leak.

Add padding field and make sure its zeroed before copy to user.

Signed-off-by: Eric Dumazet 
CC: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: packet: fix information leak to userland

2011-04-14T23:53:12+00:00

commit 67286640f638f5ad41a946b9a3dc75327950248f upstream.

packet_getname_spkt() doesn't initialize all members of sa_data field of
sockaddr struct if strlen(dev->name) < 13.  This structure is then copied
to userland.  It leads to leaking of contents of kernel stack memory.
We have to fully fill sa_data with strncpy() instead of strlcpy().

The same with packet_getname(): it doesn't initialize sll_pkttype field of
sockaddr_ll.  Set it to zero.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: David S. Miller 
Cc: Moritz Muehlenhoff 
Signed-off-by: Greg Kroah-Hartman

af_packet: Don't use skb after dev_queue_xmit()

2010-01-11T23:39:42+00:00

tpacket_snd() can change and kfree an skb after dev_queue_xmit(),
which is illegal.

With debugging by: Stephen Hemminger 

Reported-by: Michael Breuer 
With help from: David S. Miller 
Signed-off-by: Jarek Poplawski 
Tested-by: Michael Breuer
Signed-off-by: David S. Miller

packet: dont call sleeping functions while holding rcu_read_lock()

2009-12-16T05:12:21+00:00

commit 654d1f8a019dfa06d (packet: less dev_put() calls)
introduced a problem, calling potentially sleeping functions from a
rcu_read_lock() protected section.

Fix this by releasing lock before the sock_wmalloc()/memcpy_fromiovec() calls.

After skb allocation and copy from user space, we redo device
lookup and appropriate tests.

Reported-and-tested-by: Frederic Weisbecker 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: Move && and || to end of previous line

2009-11-30T00:55:45+00:00

Not including net/atm/

Compiled tested x86 allyesconfig only
Added a > 80 column line or two, which I ignored.
Existing checkpatch plaints willfully, cheerfully ignored.

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

net: use net_eq to compare nets

2009-11-25T23:14:13+00:00

Generated with the following semantic patch

@@
struct net *n1;
struct net *n2;
@@
- n1 == n2
+ net_eq(n1, n2)

@@
struct net *n1;
struct net *n2;
@@
- n1 != n2
+ !net_eq(n1, n2)

applied over {include,net,drivers/net}.

Signed-off-by: Octavian Purdila 
Signed-off-by: David S. Miller

net: netlink_getname, packet_getname -- use DECLARE_SOCKADDR guard

2009-11-11T04:54:41+00:00

Use guard DECLARE_SOCKADDR in a few more places which allow
us to catch if the structure copied back is too big.

Signed-off-by: Cyrill Gorcunov 
Signed-off-by: David S. Miller

net: pass kern to net_proto_family create function

2009-11-06T06:18:14+00:00

The generic __sock_create function has a kern argument which allows the
security system to make decisions based on if a socket is being created by
the kernel or by userspace.  This patch passes that flag to the
net_proto_family specific create function, so it can do the same thing.

Signed-off-by: Eric Paris 
Acked-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller

packet: less dev_put() calls

2009-11-02T11:41:29+00:00

- packet_sendmsg_spkt() can use dev_get_by_name_rcu() to avoid touching device refcount.

- packet_getname_spkt() & packet_getname() can use dev_get_by_index_rcu() to
  avoid touching device refcount too.

tpacket_snd() & packet_snd() can not use RCU yet because they can sleep when
allocating skb.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2009-10-30T04:28:59+00:00