From: Dan Rosenberg <drosenberg@vsecurity.com>
To: chas@cmf.nrl.navy.mil, davem@davemloft.net, kuznet@ms2.inr.ac.ru,
pekkas@netcore.fi, jmorris@namei.org, yoshfuji@linux-ipv6.org,
kaber@trash.net, remi.denis-courmont@nokia.com
Cc: netdev@vger.kernel.org, security@kernel.org, stable@kernel.org
Subject: [PATCH 4/9] Fix leaking of kernel heap addresses in net/
Date: Sun, 07 Nov 2010 11:31:52 -0500 [thread overview]
Message-ID: <1289147512.3090.141.camel@Dan> (raw)
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
diff -urp linux-2.6.37-rc1.orig/net/ipv6/raw.c linux-2.6.37-rc1/net/ipv6/raw.c
--- linux-2.6.37-rc1.orig/net/ipv6/raw.c 2010-11-01 07:54:12.000000000 -0400
+++ linux-2.6.37-rc1/net/ipv6/raw.c 2010-11-07 10:18:08.000000000 -0500
@@ -1231,7 +1231,7 @@ static void raw6_sock_seq_show(struct se
srcp = inet_sk(sp)->inet_num;
seq_printf(seq,
"%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
- "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
+ "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %d %d\n",
i,
src->s6_addr32[0], src->s6_addr32[1],
src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -1243,7 +1243,7 @@ static void raw6_sock_seq_show(struct se
0, 0L, 0,
sock_i_uid(sp), 0,
sock_i_ino(sp),
- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
+ atomic_read(&sp->sk_refcnt), 0, atomic_read(&sp->sk_drops));
}
static int raw6_seq_show(struct seq_file *seq, void *v)
diff -urp linux-2.6.37-rc1.orig/net/ipv6/tcp_ipv6.c linux-2.6.37-rc1/net/ipv6/tcp_ipv6.c
--- linux-2.6.37-rc1.orig/net/ipv6/tcp_ipv6.c 2010-11-01 07:54:12.000000000 -0400
+++ linux-2.6.37-rc1/net/ipv6/tcp_ipv6.c 2010-11-07 10:17:51.000000000 -0500
@@ -1975,7 +1975,7 @@ static void get_openreq6(struct seq_file
seq_printf(seq,
"%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
- "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
+ "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %d\n",
i,
src->s6_addr32[0], src->s6_addr32[1],
src->s6_addr32[2], src->s6_addr32[3],
@@ -1991,7 +1991,7 @@ static void get_openreq6(struct seq_file
uid,
0, /* non standard timer */
0, /* open_requests have no inode */
- 0, req);
+ 0, 0);
}
static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
@@ -2026,7 +2026,7 @@ static void get_tcp6_sock(struct seq_fil
seq_printf(seq,
"%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
- "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %lu %lu %u %u %d\n",
+ "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %d %lu %lu %u %u %d\n",
i,
src->s6_addr32[0], src->s6_addr32[1],
src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -2041,7 +2041,7 @@ static void get_tcp6_sock(struct seq_fil
sock_i_uid(sp),
icsk->icsk_probes_out,
sock_i_ino(sp),
- atomic_read(&sp->sk_refcnt), sp,
+ atomic_read(&sp->sk_refcnt), 0,
jiffies_to_clock_t(icsk->icsk_rto),
jiffies_to_clock_t(icsk->icsk_ack.ato),
(icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
@@ -2068,7 +2068,7 @@ static void get_timewait6_sock(struct se
seq_printf(seq,
"%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
- "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
+ "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %d\n",
i,
src->s6_addr32[0], src->s6_addr32[1],
src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -2076,7 +2076,7 @@ static void get_timewait6_sock(struct se
dest->s6_addr32[2], dest->s6_addr32[3], destp,
tw->tw_substate, 0, 0,
3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
- atomic_read(&tw->tw_refcnt), tw);
+ atomic_read(&tw->tw_refcnt), 0);
}
static int tcp6_seq_show(struct seq_file *seq, void *v)
diff -urp linux-2.6.37-rc1.orig/net/ipv6/udp.c linux-2.6.37-rc1/net/ipv6/udp.c
--- linux-2.6.37-rc1.orig/net/ipv6/udp.c 2010-11-01 07:54:12.000000000 -0400
+++ linux-2.6.37-rc1/net/ipv6/udp.c 2010-11-07 10:16:57.000000000 -0500
@@ -1395,7 +1395,7 @@ static void udp6_sock_seq_show(struct se
srcp = ntohs(inet->inet_sport);
seq_printf(seq,
"%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
- "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
+ "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %d %d\n",
bucket,
src->s6_addr32[0], src->s6_addr32[1],
src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -1407,7 +1407,7 @@ static void udp6_sock_seq_show(struct se
0, 0L, 0,
sock_i_uid(sp), 0,
sock_i_ino(sp),
- atomic_read(&sp->sk_refcnt), sp,
+ atomic_read(&sp->sk_refcnt), 0,
atomic_read(&sp->sk_drops));
}
reply other threads:[~2010-11-07 16:32 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1289147512.3090.141.camel@Dan \
--to=drosenberg@vsecurity.com \
--cc=chas@cmf.nrl.navy.mil \
--cc=davem@davemloft.net \
--cc=jmorris@namei.org \
--cc=kaber@trash.net \
--cc=kuznet@ms2.inr.ac.ru \
--cc=netdev@vger.kernel.org \
--cc=pekkas@netcore.fi \
--cc=remi.denis-courmont@nokia.com \
--cc=security@kernel.org \
--cc=stable@kernel.org \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).