linux-toradex.git/net/phonet/pep.c, branch v3.17.2

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11T20:15:36+00:00

Several spots in the kernel perform a sequence like:

	skb_queue_tail(&sk->s_receive_queue, skb);
	sk->sk_data_ready(sk, skb->len);

But at the moment we place the SKB onto the socket receive queue it
can be consumed and freed up.  So this skb->len access is potentially
to freed up memory.

Furthermore, the skb->len can be modified by the consumer so it is
possible that the value isn't accurate.

And finally, no actual implementation of this callback actually uses
the length argument.  And since nobody actually cared about it's
value, lots of call sites pass arbitrary values in such as '0' and
even '1'.

So just remove the length argument from the callback, that way there
is no confusion whatsoever and all of these use-after-free cases get
fixed as a side effect.

Based upon a patch by Eric Dumazet and his suggestion to audit this
issue tree-wide.

Signed-off-by: David S. Miller

hlist: drop the node parameter from iterators

2013-02-28T03:10:24+00:00

I'm not sure why, but the hlist for each entry iterators were conceived

        list_for_each_entry(pos, head, member)

The hlist ones were greedy and wanted an extra parameter:

        hlist_for_each_entry(tpos, pos, head, member)

Why did they need an extra pos parameter? I'm not quite sure. Not only
they don't really need it, it also prevents the iterator from looking
exactly like the list iterator, which is unfortunate.

Besides the semantic patch, there was some manual work required:

 - Fix up the actual hlist iterators in linux/list.h
 - Fix up the declaration of other iterators based on the hlist ones.
 - A very small amount of places were using the 'node' parameter, this
 was modified to use 'obj->member' instead.
 - Coccinelle didn't handle the hlist_for_each_entry_safe iterator
 properly, so those had to be fixed up manually.

The semantic patch which is mostly the work of Peter Senna Tschudin is here:

@@
iterator name hlist_for_each_entry, hlist_for_each_entry_continue, hlist_for_each_entry_from, hlist_for_each_entry_rcu, hlist_for_each_entry_rcu_bh, hlist_for_each_entry_continue_rcu_bh, for_each_busy_worker, ax25_uid_for_each, ax25_for_each, inet_bind_bucket_for_each, sctp_for_each_hentry, sk_for_each, sk_for_each_rcu, sk_for_each_from, sk_for_each_safe, sk_for_each_bound, hlist_for_each_entry_safe, hlist_for_each_entry_continue_rcu, nr_neigh_for_each, nr_neigh_for_each_safe, nr_node_for_each, nr_node_for_each_safe, for_each_gfn_indirect_valid_sp, for_each_gfn_sp, for_each_host;

type T;
expression a,c,d,e;
identifier b;
statement S;
@@

-T b;
    <+... when != b
(
hlist_for_each_entry(a,
- b,
c, d) S
|
hlist_for_each_entry_continue(a,
- b,
c) S
|
hlist_for_each_entry_from(a,
- b,
c) S
|
hlist_for_each_entry_rcu(a,
- b,
c, d) S
|
hlist_for_each_entry_rcu_bh(a,
- b,
c, d) S
|
hlist_for_each_entry_continue_rcu_bh(a,
- b,
c) S
|
for_each_busy_worker(a, c,
- b,
d) S
|
ax25_uid_for_each(a,
- b,
c) S
|
ax25_for_each(a,
- b,
c) S
|
inet_bind_bucket_for_each(a,
- b,
c) S
|
sctp_for_each_hentry(a,
- b,
c) S
|
sk_for_each(a,
- b,
c) S
|
sk_for_each_rcu(a,
- b,
c) S
|
sk_for_each_from
-(a, b)
+(a)
S
+ sk_for_each_from(a) S
|
sk_for_each_safe(a,
- b,
c, d) S
|
sk_for_each_bound(a,
- b,
c) S
|
hlist_for_each_entry_safe(a,
- b,
c, d, e) S
|
hlist_for_each_entry_continue_rcu(a,
- b,
c) S
|
nr_neigh_for_each(a,
- b,
c) S
|
nr_neigh_for_each_safe(a,
- b,
c, d) S
|
nr_node_for_each(a,
- b,
c) S
|
nr_node_for_each_safe(a,
- b,
c, d) S
|
- for_each_gfn_sp(a, c, d, b) S
+ for_each_gfn_sp(a, c, d) S
|
- for_each_gfn_indirect_valid_sp(a, c, d, b) S
+ for_each_gfn_indirect_valid_sp(a, c, d) S
|
for_each_host(a,
- b,
c) S
|
for_each_host_safe(a,
- b,
c, d) S
|
for_each_mesh_entry(a,
- b,
c, d) S
)
    ...+>

[akpm@linux-foundation.org: drop bogus change from net/ipv4/raw.c]
[akpm@linux-foundation.org: drop bogus hunk from net/ipv6/raw.c]
[akpm@linux-foundation.org: checkpatch fixes]
[akpm@linux-foundation.org: fix warnings]
[akpm@linux-foudnation.org: redo intrusive kvm changes]
Tested-by: Peter Senna Tschudin 
Acked-by: Paul E. McKenney 
Signed-off-by: Sasha Levin 
Cc: Wu Fengguang 
Cc: Marcelo Tosatti 
Cc: Gleb Natapov 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

net: remove my future former mail address

2012-06-17T23:29:38+00:00

Signed-off-by: Rémi Denis-Courmont 
Cc: Sakari Ailus 
Signed-off-by: David S. Miller

net: cleanup unsigned to unsigned int

2012-04-15T16:44:40+00:00

Use of "unsigned int" is preferred to bare "unsigned" in net tree.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

phonet: Check input from user before allocating

2012-04-05T23:05:56+00:00

A phonet packet is limited to USHRT_MAX bytes, this is never checked during
tx which means that the user can specify any size he wishes, and the kernel
will attempt to allocate that size.

In the good case, it'll lead to the following warning, but it may also cause
the kernel to kick in the OOM and kill a random task on the server.

[ 8921.744094] WARNING: at mm/page_alloc.c:2255 __alloc_pages_slowpath+0x65/0x730()
[ 8921.749770] Pid: 5081, comm: trinity Tainted: G        W    3.4.0-rc1-next-20120402-sasha #46
[ 8921.756672] Call Trace:
[ 8921.758185]  [] warn_slowpath_common+0x87/0xb0
[ 8921.762868]  [] warn_slowpath_null+0x15/0x20
[ 8921.765399]  [] __alloc_pages_slowpath+0x65/0x730
[ 8921.769226]  [] ? zone_watermark_ok+0x1a/0x20
[ 8921.771686]  [] ? get_page_from_freelist+0x625/0x660
[ 8921.773919]  [] __alloc_pages_nodemask+0x1f8/0x240
[ 8921.776248]  [] kmalloc_large_node+0x70/0xc0
[ 8921.778294]  [] __kmalloc_node_track_caller+0x34/0x1c0
[ 8921.780847]  [] ? sock_alloc_send_pskb+0xbc/0x260
[ 8921.783179]  [] __alloc_skb+0x75/0x170
[ 8921.784971]  [] sock_alloc_send_pskb+0xbc/0x260
[ 8921.787111]  [] ? release_sock+0x7e/0x90
[ 8921.788973]  [] sock_alloc_send_skb+0x10/0x20
[ 8921.791052]  [] pep_sendmsg+0x60/0x380
[ 8921.792931]  [] ? pn_socket_bind+0x156/0x180
[ 8921.794917]  [] ? pn_socket_autobind+0x3f/0x90
[ 8921.797053]  [] pn_socket_sendmsg+0x4f/0x70
[ 8921.798992]  [] sock_aio_write+0x187/0x1b0
[ 8921.801395]  [] ? sub_preempt_count+0xae/0xf0
[ 8921.803501]  [] ? __lock_acquire+0x42c/0x4b0
[ 8921.805505]  [] ? __sock_recv_ts_and_drops+0x140/0x140
[ 8921.807860]  [] do_sync_readv_writev+0xbc/0x110
[ 8921.809986]  [] ? might_fault+0x97/0xa0
[ 8921.811998]  [] ? security_file_permission+0x1e/0x90
[ 8921.814595]  [] do_readv_writev+0xe2/0x1e0
[ 8921.816702]  [] ? do_setitimer+0x1ac/0x200
[ 8921.818819]  [] ? get_parent_ip+0x11/0x50
[ 8921.820863]  [] ? sub_preempt_count+0xae/0xf0
[ 8921.823318]  [] vfs_writev+0x46/0x60
[ 8921.825219]  [] sys_writev+0x4f/0xb0
[ 8921.827127]  [] system_call_fastpath+0x16/0x1b
[ 8921.829384] ---[ end trace dffe390f30db9eb7 ]---

Signed-off-by: Sasha Levin 
Acked-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller

Phonet: set the pipe handle using setsockopt

2011-11-18T19:37:40+00:00

This provides flexibility to set the pipe handle
using setsockopt. The pipe can be enabled (if disabled) later
using ioctl.

Signed-off-by: Hemant Ramdasi 
Signed-off-by: Dinesh Kumar Sharma 
Acked-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller

net: Fix files explicitly needing to include module.h

2011-10-31T23:30:28+00:00

With calls to modular infrastructure, these files really
needs the full module.h header.  Call it out so some of the
cleanups of implicit and unrequired includes elsewhere can be
cleaned up.

Signed-off-by: Paul Gortmaker

Phonet: fix aligned-mode pipe socket buffer header reserve

2011-03-15T21:55:49+00:00

When the pipe uses aligned-mode data packets, we must reserve 4 bytes
instead of 3 for the pipe protocol header. Otherwise the Phonet header
would not be aligned, resulting in potentially corrupted headers with
later unaligned memory writes.

Signed-off-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller

Phonet: kill the ST-Ericsson pipe controller Kconfig

2011-03-09T19:59:33+00:00

This is now a run-time choice so that a single kernel can support both
old and new generation ISI modems. Support for manually enabling the
pipe flow is removed as it did not work properly, does not fit well
with the socket API, and I am not aware of any use at the moment.

Signed-off-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller

Phonet: support active connection without pipe controller on modem

2011-03-09T19:59:33+00:00

This provides support for newer ISI modems with no need for the
earlier experimental compile-time alternative choice. With this,
we can now use the same kernel and userspace with both types of
modems.

This also avoids confusing two different and incompatible state
machines, actively connected vs accepted sockets, and adds
connection response error handling (processing "SYN/RST" of sorts).

Signed-off-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller