linux-toradex.git/net, branch v2.6.33.12

net: fix rds_iovec page count overflow

2011-04-22T15:50:08+00:00

commit 1b1f693d7ad6d193862dcb1118540a030c5e761f upstream.

As reported by Thomas Pollet, the rdma page counting can overflow.  We
get the rdma sizes in 64-bit unsigned entities, but then limit it to
UINT_MAX bytes and shift them down to pages (so with a possible "+1" for
an unaligned address).

So each individual page count fits comfortably in an 'unsigned int' (not
even close to overflowing into signed), but as they are added up, they
might end up resulting in a signed return value. Which would be wrong.

Catch the case of tot_pages turning negative, and return the appropriate
error code.

Reported-by: Thomas Pollet 
Signed-off-by: Linus Torvalds 
Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller 
[v2: nr is unsigned in the old code]
Signed-off-by: Stefan Bader 
Acked-by: Tim Gardner 
Acked-by: Brad Figg 
Signed-off-by: Greg Kroah-Hartman

net: ax25: fix information leak to userland harder

2011-04-22T15:50:08+00:00

commit 5b919f833d9d60588d026ad82d17f17e8872c7a9 upstream.

Commit fe10ae53384e48c51996941b7720ee16995cbcb7 adds a memset() to clear
the structure being sent back to userspace, but accidentally used the
wrong size.

Reported-by: Brad Spengler 
Signed-off-by: Kees Cook 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Revert "net: fix rds_iovec page count overflow"

2011-04-15T20:52:37+00:00

This reverts commit b291661643c93044e6d4a228d3268649ccf30a0c (originally
commit 1b1f693d7ad6d193862dcb1118540a030c5e761f upstream).

I messed it up in backporting it to the .33-stable kernel, so revert it
for now and try it again the next review cycle.

Cc: Thomas Pollet 
Cc: Linus Torvalds 
Cc: Andy Grover 
Cc: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: fix rds_iovec page count overflow

2011-04-14T23:53:15+00:00

commit 1b1f693d7ad6d193862dcb1118540a030c5e761f upstream.

As reported by Thomas Pollet, the rdma page counting can overflow.  We
get the rdma sizes in 64-bit unsigned entities, but then limit it to
UINT_MAX bytes and shift them down to pages (so with a possible "+1" for
an unaligned address).

So each individual page count fits comfortably in an 'unsigned int' (not
even close to overflowing into signed), but as they are added up, they
might end up resulting in a signed return value. Which would be wrong.

Catch the case of tot_pages turning negative, and return the appropriate
error code.

Reported-by: Thomas Pollet 
Signed-off-by: Linus Torvalds 
Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

CAN: Use inode instead of kernel address for /proc file

2011-04-14T23:53:14+00:00

commit 9f260e0efa4766e56d0ac14f1aeea6ee5eb8fe83 upstream.

Since the socket address is just being used as a unique identifier, its
inode number is an alternative that does not leak potentially sensitive
information.

CC-ing stable because MITRE has assigned CVE-2010-4565 to the issue.

Signed-off-by: Dan Rosenberg 
Acked-by: Oliver Hartkopp 
Signed-off-by: David S. Miller 
Cc: Moritz Muehlenhoff 
Signed-off-by: Greg Kroah-Hartman

irda: prevent integer underflow in IRLMP_ENUMDEVICES

2011-04-14T23:53:14+00:00

commit fdac1e0697356ac212259f2147aa60c72e334861 upstream.

If the user-provided len is less than the expected offset, the
IRLMP_ENUMDEVICES getsockopt will do a copy_to_user() with a very large
size value.  While this isn't be a security issue on x86 because it will
get caught by the access_ok() check, it may leak large amounts of kernel
heap on other architectures.  In any event, this patch fixes it.

Signed-off-by: Dan Rosenberg 
Signed-off-by: David S. Miller 
Cc: Moritz Muehlenhoff 
Signed-off-by: Greg Kroah-Hartman

econet: Fix crash in aun_incoming().

2011-04-14T23:53:13+00:00

commit 4e085e76cbe558b79b54cbab772f61185879bc64 upstream.

Unconditional use of skb->dev won't work here,
try to fetch the econet device via skb_dst()->dev
instead.

Suggested by Eric Dumazet.

Reported-by: Nelson Elhage 
Tested-by: Nelson Elhage 
Signed-off-by: David S. Miller 
Cc: Moritz Muehlenhoff 
[jmm: Slightly adapted for 2.6.32]
Signed-off-by: Greg Kroah-Hartman

inet_diag: Make sure we actually run the same bytecode we audited.

2011-04-14T23:53:13+00:00

commit 22e76c849d505d87c5ecf3d3e6742a65f0ff4860 upstream.

We were using nlmsg_find_attr() to look up the bytecode by attribute when
auditing, but then just using the first attribute when actually running
bytecode. So, if we received a message with two attribute elements, where only
the second had type INET_DIAG_REQ_BYTECODE, we would validate and run different
bytecode strings.

Fix this by consistently using nlmsg_find_attr everywhere.

Signed-off-by: Nelson Elhage 
Signed-off-by: Thomas Graf 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: tipc: fix information leak to userland

2011-04-14T23:53:13+00:00

commit 88f8a5e3e7defccd3925cabb1ee4d3994e5cdb52 upstream.

Structure sockaddr_tipc is copied to userland with padding bytes after
"id" field in union field "name" unitialized.  It leads to leaking of
contents of kernel stack memory.  We have to initialize them to zero.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: David S. Miller 
Cc: Moritz Muehlenhoff 
Signed-off-by: Greg Kroah-Hartman

net: packet: fix information leak to userland

2011-04-14T23:53:12+00:00

commit 67286640f638f5ad41a946b9a3dc75327950248f upstream.

packet_getname_spkt() doesn't initialize all members of sa_data field of
sockaddr struct if strlen(dev->name) < 13.  This structure is then copied
to userland.  It leads to leaking of contents of kernel stack memory.
We have to fully fill sa_data with strncpy() instead of strlcpy().

The same with packet_getname(): it doesn't initialize sll_pkttype field of
sockaddr_ll.  Set it to zero.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: David S. Miller 
Cc: Moritz Muehlenhoff 
Signed-off-by: Greg Kroah-Hartman