Willem de Bruijn fe1fd359c1 packet: fix tp_reserve race in packet_set_ring ...

commit c27927e372f0785f3303e8fad94b85945e2c97b7 upstream.

Updates to tp_reserve can race with reads of the field in
packet_set_ring. Avoid this by holding the socket lock during
updates in setsockopt PACKET_RESERVE.

This bug was discovered by syzkaller.

Fixes: 8913336a7e ("packet: add PACKET_RESERVE sockopt")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>

2017-11-02 10:45:59 +01:00

..

9p

p9_client_readdir() fix

2017-06-20 14:04:52 +02:00

802

net/802/mrp: fix lockdep splat

2013-05-14 13:02:30 -07:00

8021q

net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev

2017-11-02 07:16:25 +01:00

appletalk

appletalk: Fix socket referencing in skb

2014-07-28 08:00:05 -07:00

atm

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

ax25

net: add validation for the socket syscall protocol argument

2016-01-22 19:47:55 -08:00

batman-adv

batman-adv: Fix broadcast/ogm queue limit on a removed interface

2016-06-07 10:42:53 +02:00

bluetooth

Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket

2017-11-01 22:12:41 +01:00

bridge

Revert "netfilter: ensure number of counters is >0 in do_replace()"

2016-08-21 23:22:32 +02:00

caif

unix/caif: sk_socket can disappear when state is unlocked

2015-06-22 16:55:51 -07:00

can

can: bcm: fix hrtimer/tasklet termination in bcm op removal

2017-06-20 14:03:12 +02:00

ceph

libceph: force GFP_NOIO for socket allocations

2017-06-20 14:04:38 +02:00

core

net: Set sk_prot_creator when cloning sockets to the right proto

2017-11-02 07:16:24 +01:00

dcb

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-06-26 15:12:37 -04:00

dccp

dccp: fix memory leak during tear-down of unsuccessful connection request

2017-06-20 14:04:31 +02:00

decnet

decnet: Do not build routes to devices without decnet private data.

2016-06-07 10:42:54 +02:00

dns_resolver

dns_resolver: Null-terminate the right string

2014-07-28 08:00:06 -07:00

dsa

dsa: fix freeing of sparse port allocation

2013-03-25 12:23:41 -04:00

ethernet

net: add ETH_P_802_3_MIN

2013-03-28 01:20:42 -04:00

ieee802154

net: 6lowpan: fix lowpan_header_create non-compression memcpy call

2017-06-08 00:47:00 +02:00

ipv4

ipv4: initialize fib_trie prior to register_netdev_notifier call.

2017-11-02 10:45:58 +01:00

ipv6

ipv6: avoid unregistering inet6_dev for loopback

2017-11-02 07:16:30 +01:00

ipx

ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg

2014-12-06 15:05:47 -08:00

irda

irda: Fix lockdep annotations in hashbin_delete().

2017-06-20 14:04:21 +02:00

iucv

af_iucv: wrong mapping of sent and confirmed skbs

2014-06-30 20:09:40 -07:00

key

xfrm: Oops on error in pfkey_msg2xfrm_state()

2017-11-02 07:16:29 +01:00

l2tp

l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv

2017-06-20 14:04:29 +02:00

lapb

net/lapb: remove depends on CONFIG_EXPERIMENTAL

2013-01-11 11:40:01 -08:00

llc

net: fix infoleak in llc

2016-06-07 10:42:54 +02:00

mac80211

mac80211: flush delayed work when entering suspend

2017-06-20 14:04:26 +02:00

mac802154

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-04-30 03:55:20 -04:00

netfilter

netfilter: xt_TCPMSS: add more sanity tests on tcph->doff

2017-11-02 07:16:23 +01:00

netlabel

netlabel: add address family checks to netlbl_{sock,req}_delattr()

2016-08-27 11:40:37 +02:00

netlink

netlink: don't hold mutex in rcu callback when releasing mmapd ring

2015-10-01 12:07:37 +02:00

netrom

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

nfc

net: rework recvmsg handler msg_name and msg_namelen logic

2013-12-08 07:29:25 -08:00

openvswitch

openvswitch: fix panic with multiple vlan headers

2014-10-15 08:31:57 +02:00

packet

packet: fix tp_reserve race in packet_set_ring

2017-11-02 10:45:59 +01:00

phonet

phonet: properly unshare skbs in phonet_rcv()

2016-01-28 21:49:34 -08:00

rds

RDS: Fix the atomicity for congestion map update

2017-06-20 14:04:52 +02:00

rfkill

net: rfkill: Do not ignore errors from regulator_enable()

2016-08-27 11:40:40 +02:00

rose

net: rose: restore old recvmsg behavior

2014-01-15 15:28:49 -08:00

rxrpc

rxrpc: Fix several cases where a padded len isn't checked in ticket decode

2017-11-01 22:12:42 +01:00

sched

net sched actions: decrement module reference count after table flush.

2017-06-08 00:47:04 +02:00

sctp

sctp: fully initialize the IPv6 address in sctp_v6_to_addr()

2017-11-02 07:16:22 +01:00

sunrpc

svcrpc: fix oops in absence of krb5 module

2017-06-08 00:46:57 +02:00

tipc

net/tipc: initialize security state for new connection socket

2015-10-01 12:07:35 +02:00

unix

af_unix: move unix_mknod() out of bindlock

2017-06-20 14:04:17 +02:00

vmw_vsock

VSOCK: do not disconnect socket when peer has shutdown SEND only

2016-06-07 10:42:54 +02:00

wimax

…

wireless

cfg80211: Check if PMKID attribute is of expected size

2017-11-02 07:16:30 +01:00

x25

net: fix a kernel infoleak in x25 module

2016-06-07 10:42:54 +02:00

xfrm

xfrm: policy: check policy direction value

2017-11-01 22:12:42 +01:00

compat.c

net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour

2015-03-26 15:00:56 +01:00

Kconfig

netlink: kconfig: move mmap i/o into netlink kconfig

2013-05-01 15:02:42 -04:00

Makefile

VSOCK: Introduce VM Sockets

2013-02-10 19:41:08 -05:00

nonet.c

…

socket.c

net: socket: fix recvmmsg not returning error from sock_error

2017-06-08 00:46:59 +02:00

sysctl_net.c

net: Update the sysctl permissions handler to test effective uid/gid

2013-10-13 16:08:34 -07:00