From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
"David S. Miller" <davem@davemloft.net>,
Herbert Xu <herbert@gondor.apana.org.au>,
Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
Neal Cardwell <ncardwell@google.com>
Subject: [ 08/27] ipv6: fix possible crashes in ip6_cork_release()
Date: Tue, 25 Jun 2013 11:35:27 -0700 [thread overview]
Message-ID: <20130625183518.652049731@linuxfoundation.org> (raw)
In-Reply-To: <20130625183517.651770593@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 284041ef21fdf2e0d216ab6b787bc9072b4eb58a ]
commit 0178b695fd6b4 ("ipv6: Copy cork options in ip6_append_data")
added some code duplication and bad error recovery, leading to potential
crash in ip6_cork_release() as kfree() could be called with garbage.
use kzalloc() to make sure this wont happen.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Cc: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_output.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1236,7 +1236,7 @@ int ip6_append_data(struct sock *sk, int
if (WARN_ON(np->cork.opt))
return -EINVAL;
- np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
+ np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation);
if (unlikely(np->cork.opt == NULL))
return -ENOBUFS;
next prev parent reply other threads:[~2013-06-25 18:35 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-06-25 18:35 [ 00/27] 3.4.51-stable review Greg Kroah-Hartman
2013-06-25 18:35 ` [ 01/27] ALSA: usb-audio: Fix invalid volume resolution for Logitech HD Webcam c310 Greg Kroah-Hartman
2013-06-25 18:35 ` [ 02/27] ALSA: usb-audio: work around Android accessory firmware bug Greg Kroah-Hartman
2013-06-25 18:35 ` [ 03/27] clk: remove notifier from list before freeing it Greg Kroah-Hartman
2013-06-25 18:35 ` [ 04/27] tilepro: work around module link error with gcc 4.7 Greg Kroah-Hartman
2013-06-25 18:35 ` [ 05/27] KVM: x86: remove vcpus CPL check in host-invoked XCR set Greg Kroah-Hartman
2013-06-25 18:35 ` [ 06/27] tcp: fix tcp_md5_hash_skb_data() Greg Kroah-Hartman
2013-06-25 18:35 ` [ 07/27] gianfar: add missing iounmap() on error in gianfar_ptp_probe() Greg Kroah-Hartman
2013-06-25 18:35 ` Greg Kroah-Hartman [this message]
2013-06-25 18:35 ` [ 09/27] netlabel: improve domain mapping validation Greg Kroah-Hartman
2013-06-25 18:35 ` [ 10/27] r8169: fix offloaded tx checksum for small packets Greg Kroah-Hartman
2013-06-25 18:35 ` [ 11/27] 8139cp: reset BQL when ring tx ring cleared Greg Kroah-Hartman
2013-06-25 18:35 ` [ 12/27] tcp: bug fix in proportional rate reduction Greg Kroah-Hartman
2013-06-25 18:35 ` [ 13/27] tcp: xps: fix reordering issues Greg Kroah-Hartman
2013-06-25 18:35 ` [ 14/27] ip_tunnel: fix kernel panic with icmp_dest_unreach Greg Kroah-Hartman
2013-06-25 18:35 ` [ 15/27] net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg Greg Kroah-Hartman
2013-06-25 18:35 ` [ 16/27] net: force a reload of first item in hlist_nulls_for_each_entry_rcu Greg Kroah-Hartman
2013-06-25 18:35 ` [ 17/27] ipv6: assign rt6_info to inet6_ifaddr in init_loopback Greg Kroah-Hartman
2013-06-25 18:35 ` [ 18/27] net: sctp: fix NULL pointer dereference in socket destruction Greg Kroah-Hartman
2013-06-25 18:35 ` [ 19/27] team: check return value of team_get_port_by_index_rcu() for NULL Greg Kroah-Hartman
2013-06-25 18:35 ` [ 20/27] packet: packet_getname_spkt: make sure string is always 0-terminated Greg Kroah-Hartman
2013-06-25 18:35 ` [ 21/27] l2tp: Fix PPP header erasure and memory leak Greg Kroah-Hartman
2013-06-25 18:35 ` [ 22/27] l2tp: Fix sendmsg() return value Greg Kroah-Hartman
2013-06-25 18:35 ` [ 23/27] bonding: rlb mode of bond should not alter ARP originating via bridge Greg Kroah-Hartman
2013-06-25 18:35 ` [ 24/27] Input: cyttsp - fix memcpy size param Greg Kroah-Hartman
2013-06-25 18:35 ` [ 25/27] USB: serial: ti_usb_3410_5052: new device id for Abbot strip port cable Greg Kroah-Hartman
2013-06-25 18:35 ` [ 26/27] target/iscsi: dont corrupt bh_count in iscsit_stop_time2retain_timer() Greg Kroah-Hartman
2013-06-25 18:35 ` [ 27/27] inotify: invalid mask should return a error number but not set it Greg Kroah-Hartman
2013-06-25 19:39 ` [ 00/27] 3.4.51-stable review Guenter Roeck
2013-06-26 3:37 ` Greg Kroah-Hartman
2013-06-26 16:58 ` Shuah Khan
2013-06-26 17:02 ` [ 00/95] 3.9.8-stable review Shuah Khan
2013-06-26 17:10 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130625183518.652049731@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=herbert@gondor.apana.org.au \
--cc=linux-kernel@vger.kernel.org \
--cc=ncardwell@google.com \
--cc=stable@vger.kernel.org \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).