summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* net: sctp: introduce uapi header for sctpDaniel Borkmann2013-04-095-16/+78
| | | | | | | | | | | | | | | | | | | | | This patch introduces an UAPI header for the SCTP protocol, so that we can facilitate the maintenance and development of user land applications or libraries, in particular in terms of header synchronization. To not break compatibility, some fragments from lksctp-tools' netinet/sctp.h have been carefully included, while taking care that neither kernel nor user land breaks, so both compile fine with this change (for lksctp-tools I tested with the old netinet/sctp.h header and with a newly adapted one that includes the uapi sctp header). lksctp-tools smoke test run through successfully as well in both cases. Suggested-by: Neil Horman <nhorman@tuxdriver.com> Cc: Neil Horman <nhorman@tuxdriver.com> Cc: Vlad Yasevich <vyasevich@gmail.com> Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* mrf24j40: use module_spi_driver to simplify the codeWei Yongjun2013-04-091-12/+1
| | | | | | | | module_spi_driver() makes the code simpler by eliminating boilerplate code. Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn> Signed-off-by: David S. Miller <davem@davemloft.net>
* netprio_cgroup: remove task_struct parameter from sock_update_netprio()Zefan Li2013-04-093-6/+6
| | | | | | | | The callers always pass current to sock_update_netprio(). Signed-off-by: Li Zefan <lizefan@huawei.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* cls_cgroup: remove task_struct parameter from sock_update_classid()Zefan Li2013-04-093-6/+6
| | | | | | | | The callers always pass current to sock_update_classid(). Signed-off-by: Li Zefan <lizefan@huawei.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* tcp_memcontrol: remove a redundant statement in tcp_destroy_cgroup()Zefan Li2013-04-091-2/+0
| | | | | | | We read the value but make no use of it. Signed-off-by: Li Zefan <lizefan@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: ipv6: only invalidate previously tokenized addressesDaniel Borkmann2013-04-092-2/+7
| | | | | | | | | | | | | | | | Instead of invalidating all IPv6 addresses with global scope when one decides to use IPv6 tokens, we should only invalidate previous tokens and leave the rest intact until they expire eventually (or are intact forever). For doing this less greedy approach, we're adding a bool at the end of inet6_ifaddr structure instead, for two reasons: i) per-inet6_ifaddr flag space is already used up, making it wider might not be a good idea, since ii) also we do not necessarily need to export this information into user space. Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: ipv6: also allow token to be set when device not readyDaniel Borkmann2013-04-091-6/+16
| | | | | | | | | | | | | When we set the iftoken in inet6_set_iftoken(), we return -EINVAL when the device does not have flag IF_READY. This is however not necessary and rather an artificial usability barrier, since we simply can set the token despite that, and in case the device is ready, we just send out our rs, otherwise ifup et al. will do this for us anyway. Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: ipv6: minor: use in6addr_any in token initDaniel Borkmann2013-04-091-1/+1
| | | | | | | | | | | Since we check for !ipv6_addr_any(&in6_dev->token) in addrconf_prefix_rcv(), make the token initialization on device setup more intuitive by using in6addr_any as an initializer. Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: cdc_ncm: demote "unexpected notification" to debug levelBjørn Mork2013-04-081-2/+3
| | | | | | | | | | | | | Receiving unhandled notifications is most certainly not an error and should not be logged as one. Knowing that the device sends notifications we don't handle is useful for developers, but there is very little a user can do about this. The message is therefore just annoying noise to most users with devices sending unhandled notifications like e.g. USB_CDC_NOTIFY_RESPONSE_AVAILABLE Cc: Alexey Orishko <alexey.orishko@stericsson.com> Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: David S. Miller <davem@davemloft.net>
* Documentation: cgroup: add documentation for net_cls cgroups.Rami Rosen2013-04-082-0/+36
| | | | | | | | This patch adds a new file, Documentation/cgroups/net_cls.txt, with info about net_cls cgroups, and updates the 00-INDEX accordingly. Signed-off-by: Rami Rosen <ramirose@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: ipv6: add tokenized interface identifier supportDaniel Borkmann2013-04-083-3/+87
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for IPv6 tokenized IIDs, that allow for administrators to assign well-known host-part addresses to nodes whilst still obtaining global network prefix from Router Advertisements. It is currently in draft status. The primary target for such support is server platforms where addresses are usually manually configured, rather than using DHCPv6 or SLAAC. By using tokenised identifiers, hosts can still determine their network prefix by use of SLAAC, but more readily be automatically renumbered should their network prefix change. [...] The disadvantage with static addresses is that they are likely to require manual editing should the network prefix in use change. If instead there were a method to only manually configure the static identifier part of the IPv6 address, then the address could be automatically updated when a new prefix was introduced, as described in [RFC4192] for example. In such cases a DNS server might be configured with such a tokenised interface identifier of ::53, and SLAAC would use the token in constructing the interface address, using the advertised prefix. [...] http://tools.ietf.org/html/draft-chown-6man-tokenised-ipv6-identifiers-02 The implementation is partially based on top of Mark K. Thompson's proof of concept. However, it uses the Netlink interface for configuration resp. data retrival, so that it can be easily extended in future. Successfully tested by myself. Cc: Hannes Frederic Sowa <hannes@stressinduktion.org> Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Cc: Thomas Graf <tgraf@suug.ch> Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* stmmac: prefetch all dma_erx when use extend_descGiuseppe CAVALLARO2013-04-081-6/+3
| | | | | | | | This patch is to prefetch, in the stmmac_rx, the whole dma_erx descriptor in case of using the extended descriptors. Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* stmmac: review private structure fieldsGiuseppe CAVALLARO2013-04-081-34/+34
| | | | | | | | | | | | | | | recently many new supports have been added in the stmmac driver w/o taking care about where each new field had to be placed inside the private structure for guaranteeing the best cache usage. This is what I wanted in the beginning, so this patch reorganizes all the fields in order to keep adjacent fields for cache effect. I have also tried to optimize them by using pahole. V2: do not abuse with ____cacheline_aligned_in_smp and keep fields that potentially could stay in the same cache-line for better usage in SMP systems. Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* stmmac: code tidy-upGiuseppe CAVALLARO2013-04-0817-309/+311
| | | | | | | | | This patch tidies up the code. I have run Linden (and verified with checkpatch) many part of the driver trying to reorganize some sections respecting the codying-style rules in the points where it was not done. Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* stmmac: improve/review and fix kernel-docGiuseppe CAVALLARO2013-04-082-50/+142
| | | | | | | | this patch reviews/improves and adds some fixes in the code doc. Also kernel-doc passes w/o any warnings. Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* stmmac: review driver documentationGiuseppe CAVALLARO2013-04-081-4/+8
| | | | | | | | | | This patch reviews the driver documentation file; for example, there were some new fields (in the driver module parameter section) and the ptp files were not documented. Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* stmmac: modified pcs mode support for SGMIIByungho An2013-04-081-4/+8
| | | | | | | | | This patch modifies the pcs mode support for SGMII. Even though SGMII does auto-negotiation with phy, it needs stmmac_init_phy and stmmac_mdio_register function for initializing phy. Signed-off-by: Byungho An <bh74.an@samsung.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: of_mdio: scan mdiobus for PHYs without reg propertySebastian Hesselbarth2013-04-081-6/+58
| | | | | | | | | | | | Using DT for mdiobus and ethernet-phy requires to know the PHY address, which is hard to guess if you don't know it. This patch extends of_mdiobus_register to scan mdiobus for PHYs if reg property of the corresponding node is not set. This also allows to have phy nodes in SoC DT files where the reg property can be overwritten in the board file later. To encourage people to finally set the actual phy address, the mdiobus scan is noisier than required. Signed-off-by: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: mvmdio: get and enable optional clockSebastian Hesselbarth2013-04-081-0/+11
| | | | | | | | | | Marvell mdio driver uses internal registers that can be clock gated on some SoCs. This patch just adds optional clock handling, to allow to pass and enable the corresponding clock. Signed-off-by: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com> Acked-by: Florian Fainelli <florian@openwrt.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: ks8851: Use dev_pm_opsLars-Peter Clausen2013-04-081-17/+20
| | | | | | | Use dev_pm_ops instead of the deprecated legacy suspend/resume callbacks. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: ks8851: Use module_spi_driverLars-Peter Clausen2013-04-081-13/+1
| | | | | | | By using module_spi_driver we can eliminate a few lines of boilerplate code. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* mac802154: Keep track of the channel when changedAlan Ott2013-04-082-1/+14
| | | | | | | | | | | | | | | Two sections checked whether the current channel != the new channel without ever setting the current channel variables. 1. net/mac802154/tx.c: Prevent set_channel() from getting called every time a packet is sent. 2. net/mac802154/mib.c: Lock (pib_lock) accesses to current_channel and current_page and make sure they are updated when the channel has been changed. Signed-off-by: Alan Ott <alan@signal11.us> Signed-off-by: David S. Miller <davem@davemloft.net>
* mrf24j40: Enable link-layer acknowledgement and retryAlan Ott2013-04-081-2/+5
| | | | | | | | | | | | | On the MRF24J40, link-layer acknowledgment request and retry must be turned on explicitly for each packet. Turn this on in the hardware based on the FC_ACK_REQ bit being set in the packet. Also, now that failure to receive an ACK will cause the hardware to report failure of transmission, change the log level for this failure to debug level. Signed-off-by: Alan Ott <alan@signal11.us> Signed-off-by: David S. Miller <davem@davemloft.net>
* TTY: ircomm, use GFP_KERNEL in ircomm_open()Mathias Krause2013-04-081-1/+1
| | | | | | | | | | | | | | | | | | | | | Hi Greg, I'm unsure if you or Dave should take that one as it's for one a TTY patch but also living under net/. So I'm uncertain and let you decide! Thanks, Mathias -- >8 -- Subject: [PATCH] TTY: ircomm, use GFP_KERNEL in ircomm_open() We're clearly running in non-atomic context as our only call site is able to call wait_event_interruptible(). So we're safe to use GFP_KERNEL here instead of GFP_ATOMIC. Signed-off-by: Mathias Krause <minipli@googlemail.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* irda: use GFP_KERNEL in irda_connect_response()Mathias Krause2013-04-081-2/+1
| | | | | | | | | The only call site of irda_connect_response() is irda_accept() -- a function called from user context only. Therefore it has no need for GFP_ATOMIC. Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* irda: use GFP_KERNEL in irda_create()Mathias Krause2013-04-081-1/+1
| | | | | | | | irda_create() is called from user context only, therefore has no need for GFP_ATOMIC. Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ip_gre: fix a possible crash in parse_gre_header()Eric Dumazet2013-04-081-3/+5
| | | | | | | | | | | pskb_may_pull() can change skb->head, so we must init iph/greh after calling it. Bug added in commit c54419321455 (GRE: Refactor GRE tunneling code.) Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Pravin B Shelar <pshelar@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* at86rf230: remove unnecessary / dead codeSascha Herrmann2013-04-081-2/+0
| | | | | | | | | In at86rf230_probe() lp was first set to dev->priv and a few lines later dev->priv was set to lp again, without changing lp in between. The call to ieee802154_unregister_device() before err_irq: was unreachable. Signed-off-by: Sascha Herrmann <sascha@ps.nvbi.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* enic: be less verbose about non-critical firmware errorsStefan Assmann2013-04-081-0/+3
| | | | | | | | | If a feature is not supported by firmware no need to print an error message. This surpresses the following harmless message on boot up and ethtool query. enic: Error 1 devcmd 36 Signed-off-by: Stefan Assmann <sassmann@kpanic.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* ieee802154/nl-mac.c: make some MLME operations optionalWerner Almesberger2013-04-083-7/+27
| | | | | | | | | | | | | | | | | | | | | Check for NULL before calling the following operations from "struct ieee802154_mlme_ops": assoc_req, assoc_resp, disassoc_req, start_req, and scan_req. This fixes a current oops where those functions are called but not implemented. It also updates the documentation to clarify that they are now optional by design. If a call to an unimplemented function is attempted, the kernel returns EOPNOTSUPP via netlink. The following operations are still required: get_phy, get_pan_id, get_short_addr, and get_dsn. Note that the places where this patch changes the initialization of "ret" should not affect the rest of the code since "ret" was always set (again) before returning its value. Signed-off-by: Werner Almesberger <werner@almesberger.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* IEEE 802.15.4: remove get_bsn from "struct ieee802154_mlme_ops"Werner Almesberger2013-04-082-22/+0
| | | | | | | | | | | | It served no purpose: we never call it from anywhere in the stack and the only driver that did implement it (fakehard) merely provided a dummy value. There is also considerable doubt whether it would make sense to even attempt beacon processing at this level in the Linux kernel. Signed-off-by: Werner Almesberger <werner@almesberger.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* scm: Stop passing struct credEric W. Biederman2013-04-074-35/+16
| | | | | | | | | | | | | Now that uids and gids are completely encapsulated in kuid_t and kgid_t we no longer need to pass struct cred which allowed us to test both the uid and the user namespace for equality. Passing struct cred potentially allows us to pass the entire group list as BSD does but I don't believe the cost of cache line misses justifies retaining code for a future potential application. Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2013-04-07135-450/+852
|\ | | | | | | | | | | | | | | | | | | | | Conflicts: drivers/nfc/microread/mei.c net/netfilter/nfnetlink_queue_core.c Pull in 'net' to get Eric Biederman's AF_UNIX fix, upon which some cleanups are going to go on-top. Signed-off-by: David S. Miller <davem@davemloft.net>
| * bnx2x: Fix KR2 rapid link flapYaniv Rosner2013-04-071-7/+11
| | | | | | | | | | | | | | | | Check KR2 recovery time at the beginning of the work-around function. Signed-off-by: Yaniv Rosner <yanivr@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * sctp: remove 'sridhar' from maintainers listSridhar Samudrala2013-04-071-1/+0
| | | | | | | | | | | | | | Update SCTP maintainers list. Signed-off-by: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * Merge branch 'infoleaks'David S. Miller2013-04-0716-3/+32
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mathias Krause says: ==================== a few more info leak fixes in the recvmsg path. The error pattern here is the protocol specific recvmsg function is missing the msg_namelen assignment -- either completely or in early exit paths that do not result in errors in __sys_recvmsg()/sys_recvfrom() and, in turn, make them call move_addr_to_user(), leaking the then still uninitialized sockaddr_storage stack variable to userland. My audit was initiated by a rather coarse fix of the leak that can be found in the grsecurity patch, putting a penalty on protocols complying to the rules of recvmsg. So credits for finding the leak in the recvmsg path in __sys_recvmsg() should go to Brad! The buggy protocols/subsystems are rather obscure anyway. As a missing assignment of msg_namelen coupled with a missing filling of msg_name would only result in garbage -- the leak -- in case userland would care about that information, i.e. would provide a msg_name pointer. But obviously current userland does not. While auditing the code for the above pattern I found a few more 'uninitialized members' kind of leaks related to the msg_name filling. Those are fixed in this series, too. I have to admit, I failed to test all of the patches due to missing hardware, e.g. iucv depends on S390 -- hardware I've no access to :/ ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| | * VSOCK: Fix missing msg_namelen update in vsock_stream_recvmsg()Mathias Krause2013-04-071-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The code misses to update the msg_namelen member to 0 and therefore makes net/socket.c leak the local, uninitialized sockaddr_storage variable to userland -- 128 bytes of kernel stack memory. Cc: Andy King <acking@vmware.com> Cc: Dmitry Torokhov <dtor@vmware.com> Cc: George Zhang <georgezhang@vmware.com> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * VSOCK: vmci - fix possible info leak in vmci_transport_dgram_dequeue()Mathias Krause2013-04-071-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In case we received no data on the call to skb_recv_datagram(), i.e. skb->data is NULL, vmci_transport_dgram_dequeue() will return with 0 without updating msg_namelen leading to net/socket.c leaking the local, uninitialized sockaddr_storage variable to userland -- 128 bytes of kernel stack memory. Fix this by moving the already existing msg_namelen assignment a few lines above. Cc: Andy King <acking@vmware.com> Cc: Dmitry Torokhov <dtor@vmware.com> Cc: George Zhang <georgezhang@vmware.com> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * tipc: fix info leaks via msg_name in recv_msg/recv_streamMathias Krause2013-04-071-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The code in set_orig_addr() does not initialize all of the members of struct sockaddr_tipc when filling the sockaddr info -- namely the union is only partly filled. This will make recv_msg() and recv_stream() -- the only users of this function -- leak kernel stack memory as the msg_name member is a local variable in net/socket.c. Additionally to that both recv_msg() and recv_stream() fail to update the msg_namelen member to 0 while otherwise returning with 0, i.e. "success". This is the case for, e.g., non-blocking sockets. This will lead to a 128 byte kernel stack leak in net/socket.c. Fix the first issue by initializing the memory of the union with memset(0). Fix the second one by setting msg_namelen to 0 early as it will be updated later if we're going to fill the msg_name member. Cc: Jon Maloy <jon.maloy@ericsson.com> Cc: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * rose: fix info leak via msg_name in rose_recvmsg()Mathias Krause2013-04-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The code in rose_recvmsg() does not initialize all of the members of struct sockaddr_rose/full_sockaddr_rose when filling the sockaddr info. Nor does it initialize the padding bytes of the structure inserted by the compiler for alignment. This will lead to leaking uninitialized kernel stack bytes in net/socket.c. Fix the issue by initializing the memory used for sockaddr info with memset(0). Cc: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * NFC: llcp: fix info leaks via msg_name in llcp_sock_recvmsg()Mathias Krause2013-04-071-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The code in llcp_sock_recvmsg() does not initialize all the members of struct sockaddr_nfc_llcp when filling the sockaddr info. Nor does it initialize the padding bytes of the structure inserted by the compiler for alignment. Also, if the socket is in state LLCP_CLOSED or is shutting down during receive the msg_namelen member is not updated to 0 while otherwise returning with 0, i.e. "success". The msg_namelen update is also missing for stream and seqpacket sockets which don't fill the sockaddr info. Both issues lead to the fact that the code will leak uninitialized kernel stack bytes in net/socket.c. Fix the first issue by initializing the memory used for sockaddr info with memset(0). Fix the second one by setting msg_namelen to 0 early. It will be updated later if we're going to fill the msg_name member. Cc: Lauro Ramos Venancio <lauro.venancio@openbossa.org> Cc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org> Cc: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * netrom: fix info leak via msg_name in nr_recvmsg()Mathias Krause2013-04-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In case msg_name is set the sockaddr info gets filled out, as requested, but the code fails to initialize the padding bytes of struct sockaddr_ax25 inserted by the compiler for alignment. Also the sax25_ndigis member does not get assigned, leaking four more bytes. Both issues lead to the fact that the code will leak uninitialized kernel stack bytes in net/socket.c. Fix both issues by initializing the memory with memset(0). Cc: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * llc: Fix missing msg_namelen update in llc_ui_recvmsg()Mathias Krause2013-04-071-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For stream sockets the code misses to update the msg_namelen member to 0 and therefore makes net/socket.c leak the local, uninitialized sockaddr_storage variable to userland -- 128 bytes of kernel stack memory. The msg_namelen update is also missing for datagram sockets in case the socket is shutting down during receive. Fix both issues by setting msg_namelen to 0 early. It will be updated later if we're going to fill the msg_name member. Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * l2tp: fix info leak in l2tp_ip6_recvmsg()Mathias Krause2013-04-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The L2TP code for IPv6 fails to initialize the l2tp_conn_id member of struct sockaddr_l2tpip6 and therefore leaks four bytes kernel stack in l2tp_ip6_recvmsg() in case msg_name is set. Initialize l2tp_conn_id with 0 to avoid the info leak. Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * iucv: Fix missing msg_namelen update in iucv_sock_recvmsg()Mathias Krause2013-04-071-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current code does not fill the msg_name member in case it is set. It also does not set the msg_namelen member to 0 and therefore makes net/socket.c leak the local, uninitialized sockaddr_storage variable to userland -- 128 bytes of kernel stack memory. Fix that by simply setting msg_namelen to 0 as obviously nobody cared about iucv_sock_recvmsg() not filling the msg_name in case it was set. Cc: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * irda: Fix missing msg_namelen update in irda_recvmsg_dgram()Mathias Krause2013-04-071-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current code does not fill the msg_name member in case it is set. It also does not set the msg_namelen member to 0 and therefore makes net/socket.c leak the local, uninitialized sockaddr_storage variable to userland -- 128 bytes of kernel stack memory. Fix that by simply setting msg_namelen to 0 as obviously nobody cared about irda_recvmsg_dgram() not filling the msg_name in case it was set. Cc: Samuel Ortiz <samuel@sortiz.org> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * caif: Fix missing msg_namelen update in caif_seqpkt_recvmsg()Mathias Krause2013-04-071-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current code does not fill the msg_name member in case it is set. It also does not set the msg_namelen member to 0 and therefore makes net/socket.c leak the local, uninitialized sockaddr_storage variable to userland -- 128 bytes of kernel stack memory. Fix that by simply setting msg_namelen to 0 as obviously nobody cared about caif_seqpkt_recvmsg() not filling the msg_name in case it was set. Cc: Sjur Braendeland <sjur.brandeland@stericsson.com> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * Bluetooth: SCO - Fix missing msg_namelen update in sco_sock_recvmsg()Mathias Krause2013-04-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the socket is in state BT_CONNECT2 and BT_SK_DEFER_SETUP is set in the flags, sco_sock_recvmsg() returns early with 0 without updating the possibly set msg_namelen member. This, in turn, leads to a 128 byte kernel stack leak in net/socket.c. Fix this by updating msg_namelen in this case. For all other cases it will be handled in bt_sock_recvmsg(). Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg()Mathias Krause2013-04-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If RFCOMM_DEFER_SETUP is set in the flags, rfcomm_sock_recvmsg() returns early with 0 without updating the possibly set msg_namelen member. This, in turn, leads to a 128 byte kernel stack leak in net/socket.c. Fix this by updating msg_namelen in this case. For all other cases it will be handled in bt_sock_stream_recvmsg(). Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| | * Bluetooth: fix possible info leak in bt_sock_recvmsg()Mathias Krause2013-04-071-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In case the socket is already shutting down, bt_sock_recvmsg() returns with 0 without updating msg_namelen leading to net/socket.c leaking the local, uninitialized sockaddr_storage variable to userland -- 128 bytes of kernel stack memory. Fix this by moving the msg_namelen assignment in front of the shutdown test. Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Signed-off-by: Mathias Krause <minipli@googlemail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.25.1) at 2025-03-02 18:33:13 +0000