linux-stable.git/net/sctp/socket.c, branch linux-2.6.26.y

sctp: fix random memory dereference with SCTP_HMAC_IDENT option.

2008-09-08T11:44:25+00:00

[ Upstream commit d97240552cd98c4b07322f30f66fd9c3ba4171de ]

The number of identifiers needs to be checked against the option
length.  Also, the identifier index provided needs to be verified
to make sure that it doesn't exceed the bounds of the array.

Signed-off-by: Vlad Yasevich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

sctp: correct bounds check in sctp_setsockopt_auth_key

2008-09-08T11:44:25+00:00

[ Upstream commit 328fc47ea0bcc27d9afa69c3ad6e52431cadd76c ]

The bonds check to prevent buffer overlflow was not exactly
right.  It still allowed overflow of up to 8 bytes which is
sizeof(struct sctp_authkey).

Since optlen is already checked against the size of that struct,
we are guaranteed not to cause interger overflow either.

Signed-off-by: Vlad Yasevich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

sctp: add verification checks to SCTP_AUTH_KEY option

2008-09-08T11:44:24+00:00

[ Upstream commit 30c2235cbc477d4629983d440cdc4f496fec9246 ]

The structure used for SCTP_AUTH_KEY option contains a
length that needs to be verfied to prevent buffer overflow
conditions.  Spoted by Eugene Teo .

Signed-off-by: Vlad Yasevich 
Signed-off-by: David S. Miller 
Acked-by: Eugene Teo 
Signed-off-by: Greg Kroah-Hartman

sctp: fix potential panics in the SCTP-AUTH API.

2008-09-08T11:44:24+00:00

[ Upstream commit 5e739d1752aca4e8f3e794d431503bfca3162df4 ]

All of the SCTP-AUTH socket options could cause a panic
if the extension is disabled and the API is envoked.

Additionally, there were some additional assumptions that
certain pointers would always be valid which may not
always be the case.

This patch hardens the API and address all of the crash
scenarios.

Signed-off-by: Vlad Yasevich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

sctp: Make sure N * sizeof(union sctp_addr) does not overflow.

2008-06-21T05:04:34+00:00

As noticed by Gabriel Campana, the kmalloc() length arg
passed in by sctp_getsockopt_local_addrs_old() can overflow
if ->addr_num is large enough.

Therefore, enforce an appropriate limit.

Signed-off-by: David S. Miller

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2008-04-14T09:30:23+00:00

Conflicts:

	drivers/net/ehea/ehea_main.c
	drivers/net/wireless/iwlwifi/Kconfig
	drivers/net/wireless/rt2x00/rt61pci.c
	net/ipv4/inet_timewait_sock.c
	net/ipv6/raw.c
	net/mac80211/ieee80211_sta.c

[SCTP]: "list_for_each()" -> "list_for_each_entry()" where appropriate.

2008-04-13T01:54:24+00:00

Replacing (almost) all invocations of list_for_each() with
list_for_each_entry() tightens up the code and allows for the deletion
of numerous list iterator variables that are no longer necessary.

Signed-off-by: Robert P. J. Day 
Signed-off-by: Vlad Yasevich 
Signed-off-by: David S. Miller

[SCTP]: Fix compiler warning about const qualifiers

2008-04-13T01:40:06+00:00

Fix 3 warnings about discarding const qualifiers:

net/sctp/ulpevent.c:862: warning: passing argument 1 of 'sctp_event2skb' discards qualifiers from pointer target type
net/sctp/sm_statefuns.c:4393: warning: passing argument 1 of 'SCTP_ASOC' discards qualifiers from pointer target type
net/sctp/socket.c:5874: warning: passing argument 1 of 'cmsg_nxthdr' discards qualifiers from pointer target type

Signed-off-by: Vlad Yasevich 
Signed-off-by: David S. Miller

SCTP: fix wrong debug counting of bind_bucket

2008-04-10T08:58:06+00:00

Should not count it if the allocation of the object
is failed.

Signed-off-by: Li Zefan 
Signed-off-by: David S. Miller

[SOCK]: Drop inuse pcounter from struct proto (v2).

2008-03-28T23:39:33+00:00

An uppercut - do not use the pcounter on struct proto.

Signed-off-by: Pavel Emelyanov 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller