linux-toradex.git/net/irda/af_irda.c, branch v3.4.71

irda: Fix missing msg_namelen update in irda_recvmsg_dgram()

2013-05-01T16:41:05+00:00

[ Upstream commit 5ae94c0d2f0bed41d6718be743985d61b7f5c47d ]

The current code does not fill the msg_name member in case it is set.
It also does not set the msg_namelen member to 0 and therefore makes
net/socket.c leak the local, uninitialized sockaddr_storage variable
to userland -- 128 bytes of kernel stack memory.

Fix that by simply setting msg_namelen to 0 as obviously nobody cared
about irda_recvmsg_dgram() not filling the msg_name in case it was
set.

Signed-off-by: Mathias Krause 
Cc: Samuel Ortiz 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net/irda: add missing error path release_sock call

2013-04-05T17:04:34+00:00

commit 896ee0eee6261e30c3623be931c3f621428947df upstream.

This makes sure that release_sock is called for all error conditions in
irda_getsockopt.

Signed-off-by: Kees Cook 
Reported-by: Brad Spengler 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

irda: use msecs_to_jiffies() rather than manual calculation

2011-12-21T20:46:22+00:00

Also use mod_timer() instead of direct assignment to "expires".

Signed-off-by: Xi Wang 
Signed-off-by: David S. Miller

net: Remove casts of void *

2011-06-17T03:19:27+00:00

Unnecessary casts of void * clutter the code.

These are the remainder casts after several specific
patches to remove netdev_priv and dev_priv.

Done via coccinelle script:

$ cat cast_void_pointer.cocci
@@
type T;
T *pt;
void *pv;
@@

- pt = (T *)pv;
+ pt = pv;

Signed-off-by: Joe Perches 
Acked-by: Paul Moore 
Signed-off-by: David S. Miller

irda: fix locking unbalance in irda_sendmsg

2011-04-12T22:29:54+00:00

5b40964eadea40509d353318d2c82e8b7bf5e8a5 ("irda: Remove BKL instances
from af_irda.c") introduced a path where we have a locking unbalance.
If we pass invalid flags, we unlock a socket we never locked,
resulting in this...

=====================================
[ BUG: bad unlock balance detected! ]
-------------------------------------
trinity/20101 is trying to release lock (sk_lock-AF_IRDA) at:
[] irda_sendmsg+0x207/0x21d [irda]
but there are no more locks to release!

other info that might help us debug this:
no locks held by trinity/20101.

stack backtrace:
Pid: 20101, comm: trinity Not tainted 2.6.39-rc3+ #3
Call Trace:
 [] ? irda_sendmsg+0x207/0x21d [irda]
 [] print_unlock_inbalance_bug+0xc7/0xd2
 [] ? irda_sendmsg+0x207/0x21d [irda]
 [] lock_release+0xcf/0x18e
 [] release_sock+0x2d/0x155
 [] irda_sendmsg+0x207/0x21d [irda]
 [] __sock_sendmsg+0x69/0x75
 [] sock_sendmsg+0xa1/0xb6
 [] ? might_fault+0x5c/0xac
 [] ? lock_release+0x181/0x18e
 [] ? might_fault+0xa5/0xac
 [] ? might_fault+0x5c/0xac
 [] ? fcheck_files+0xb9/0xf0
 [] ? copy_from_user+0x2f/0x31
 [] ? verify_iovec+0x52/0xa6
 [] sys_sendmsg+0x23a/0x2b8
 [] ? lock_release+0x181/0x18e
 [] ? up_read+0x28/0x2c
 [] ? do_page_fault+0x360/0x3b4
 [] ? trace_hardirqs_on_caller+0x10b/0x12f
 [] ? finish_task_switch+0xb2/0xe3
 [] ? finish_task_switch+0x46/0xe3
 [] ? trace_hardirqs_off_caller+0x33/0x90
 [] ? retint_swapgs+0x13/0x1b
 [] ? trace_hardirqs_on_caller+0x10b/0x12f
 [] ? audit_syscall_entry+0x11c/0x148
 [] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [] system_call_fastpath+0x16/0x1b

Signed-off-by: Dave Jones 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

2010-12-26T20:06:56+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits)
  ipv4: dont create routes on down devices
  epic100: hamachi: yellowfin: Fix skb allocation size
  sundance: Fix oopses with corrupted skb_shared_info
  Revert "ipv4: Allow configuring subnets as local addresses"
  USB: mcs7830: return negative if auto negotiate fails
  irda: prevent integer underflow in IRLMP_ENUMDEVICES
  tcp: fix listening_get_next()
  atl1c: Do not use legacy PCI power management
  mac80211: fix mesh forwarding
  MAINTAINERS: email address change
  net: Fix range checks in tcf_valid_offset().
  net_sched: sch_sfq: fix allot handling
  hostap: remove netif_stop_queue from init
  mac80211/rt2x00: add ieee80211_tx_status_ni()
  typhoon: memory corruption in typhoon_get_drvinfo()
  net: Add USB PID for new MOSCHIP USB ethernet controller MCS7832 variant
  net_sched: always clone skbs
  ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed.
  netlink: fix gcc -Wconversion compilation warning
  asix: add USB ID for Logitec LAN-GTJ U2A
  ...

irda: prevent integer underflow in IRLMP_ENUMDEVICES

2010-12-23T18:09:43+00:00

If the user-provided len is less than the expected offset, the
IRLMP_ENUMDEVICES getsockopt will do a copy_to_user() with a very large
size value.  While this isn't be a security issue on x86 because it will
get caught by the access_ok() check, it may leak large amounts of kernel
heap on other architectures.  In any event, this patch fixes it.

Signed-off-by: Dan Rosenberg 
Signed-off-by: David S. Miller

BKL: remove extraneous #include

2010-11-17T16:59:32+00:00

The big kernel lock has been removed from all these files at some point,
leaving only the #include.

Remove this too as a cleanup.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Linus Torvalds

irda: Remove BKL instances from af_irda.c

2010-10-11T00:11:23+00:00

Most of the times, lock_kernel() was pointless or could simply be replaced
by lock_sock().

Signed-off-by: Samuel Ortiz

net: return operator cleanup

2010-09-23T21:33:39+00:00

Change "return (EXPR);" to "return EXPR;"

return is not a function, parentheses are not required.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller