linux/net/core
Eric Dumazet 77125815f0 net: avoid signed overflows for SO_{SND|RCV}BUFFORCE
[ Upstream commit b98b0bc8c4 ]

CAP_NET_ADMIN users should not be allowed to set negative
sk_sndbuf or sk_rcvbuf values, as it can lead to various memory
corruptions, crashes, OOM...

Note that before commit 8298193012 ("net: cleanups in
sock_setsockopt()"), the bug was even more serious, since SO_SNDBUF
and SO_RCVBUF were vulnerable.

This needs to be backported to all known linux kernels.

Again, many thanks to syzkaller team for discovering this gem.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-12-10 19:07:24 +01:00
..
datagram.c
dev_addr_lists.c
dev_ioctl.c
dev.c net: mangle zero checksum in skb_checksum_help() 2016-11-21 10:06:39 +01:00
drop_monitor.c
dst.c
ethtool.c
fib_rules.c
filter.c tcp: take care of truncations done by sk_filter() 2016-11-21 10:06:40 +01:00
flow_dissector.c flow_dissect: call init_default_flow_dissectors() earlier 2016-12-02 09:09:02 +01:00
flow.c
gen_estimator.c
gen_stats.c
link_watch.c
lwtunnel.c
Makefile
neighbour.c neigh: Explicitly declare RCU-bh read side critical section in neigh_xmit() 2016-07-11 09:31:12 -07:00
net_namespace.c net: check dead netns for peernet2id_alloc() 2016-12-10 19:07:22 +01:00
net-procfs.c
net-sysfs.c
net-sysfs.h
net-traces.c
netclassid_cgroup.c
netevent.c
netpoll.c
netprio_cgroup.c
pktgen.c net: pktgen: remove rcu locking in pktgen_change_name() 2016-11-15 07:46:38 +01:00
ptp_classifier.c
request_sock.c
rtnetlink.c rtnetlink: fix FDB size computation 2016-12-10 19:07:22 +01:00
scm.c
secure_seq.c
skbuff.c net_sched: fix mirrored packets checksum 2016-07-27 09:47:31 -07:00
sock_diag.c
sock.c net: avoid signed overflows for SO_{SND|RCV}BUFFORCE 2016-12-10 19:07:24 +01:00
stream.c
sysctl_net_core.c
timestamping.c
tso.c
utils.c