github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-10 07:32:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
df0b962e09
linux/net
History
Mikulas Patocka 43da476d7f Fix order of arguments to compat_put_time[spec|val] 
commit ed6fe9d614 upstream.

Commit 644595f896 ("compat: Handle COMPAT_USE_64BIT_TIME in
net/socket.c") introduced a bug where the helper functions to take
either a 64-bit or compat time[spec|val] got the arguments in the wrong
order, passing the kernel stack pointer off as a user pointer (and vice
versa).

Because of the user address range check, that in turn then causes an
EFAULT due to the user pointer range checking failing for the kernel
address.  Incorrectly resuling in a failed system call for 32-bit
processes with a 64-bit kernel.

On odder architectures like HP-PA (with separate user/kernel address
spaces), it can be used read kernel memory.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-09-14 10:00:23 -07:00
..
9p 9p: BUG before corrupting memory 2012-06-22 11:37:15 -07:00
802 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2012-04-02 17:53:39 -07:00
8021q net: Fix memory leak - vlan_info struct 2012-08-09 08:31:41 -07:00
appletalk
atm Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
ax25 net ax25: Reorder ax25_exit to remove races. 2012-04-19 15:37:48 -04:00
batman-adv batman-adv: only drop packets of known wifi clients 2012-07-16 09:04:11 -07:00
bluetooth Bluetooth: Fix legacy pairing with some devices 2012-09-14 10:00:18 -07:00
bridge bridge: Assign rtnl_link_ops to bridge devices created via ioctl (v2) 2012-07-16 09:03:49 -07:00
caif caif: Fix access to freed pernet memory 2012-08-09 08:31:42 -07:00
can net: remove skb_orphan_try() 2012-07-16 09:03:48 -07:00
ceph libceph: isolate kmap() call in write_partial_msg_pages() 2012-03-22 10:47:52 -05:00
core net: feed /dev/random with the MAC address when registering a device 2012-08-15 08:10:28 -07:00
dcb
dccp dccp: fix bug in sequence number validation during connection setup 2012-03-03 09:02:52 -07:00
decnet Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
dns_resolver KEYS: Allow special keyrings to be cleared 2012-01-19 14:38:51 +11:00
dsa dsa: Move switch drivers to new directory drivers/net/dsa 2011-11-29 00:21:36 -05:00
econet Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
ethernet Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
ieee802154 6lowpan: add missing spin_lock_init() 2012-04-26 05:32:55 -04:00
ipv4 tcp: perform DMA to userspace only if there is a task waiting for it 2012-08-09 08:31:51 -07:00
ipv6 ipv6: Move ipv6 proc file registration to end of init order 2012-07-16 09:03:46 -07:00
ipx
irda Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
iucv net: remove skb_orphan_try() 2012-07-16 09:03:48 -07:00
key net/key/af_key.c: add missing kfree_skb 2012-04-13 11:01:44 -04:00
l2tp l2tp: fix a race in l2tp_ip_sendmsg() 2012-07-16 09:03:45 -07:00
lapb Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
llc llc: Fix race condition in llc_ui_recvmsg 2012-01-24 15:33:19 -05:00
mac80211 mac80211: cancel mesh path timer 2012-08-15 08:10:09 -07:00
netfilter netfilter: ipset: fix hash size checking in kernel 2012-05-16 15:38:49 -04:00
netlabel netlabel: use GFP flags from caller instead of GFP_ATOMIC 2012-03-22 19:29:57 -04:00
netlink netlink: fix races after skb queueing 2012-04-06 04:21:06 -04:00
netrom Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
nfc NFC: Prevent multiple buffer overflows in NCI 2012-07-16 09:03:50 -07:00
openvswitch openvswitch: checking wrong variable in queue_userspace_packet() 2012-05-13 15:47:34 -04:00
packet Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
phonet phonet: Sort out initiailziation and cleanup code. 2012-04-13 11:01:43 -04:00
rds RDS: use gfp flags from caller in conn_alloc() 2012-03-22 19:29:58 -04:00
rfkill device.h: cleanup users outside of linux/include (C files) 2012-03-11 14:27:37 -04:00
rose Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2012-04-02 17:53:39 -07:00
rxrpc RxRPC: Fix kcalloc parameters swapped 2012-02-14 14:41:55 -05:00
sched sch_sfb: Fix missing NULL check 2012-08-09 08:31:42 -07:00
sctp sctp: Fix list corruption resulting from freeing an association on a list 2012-08-09 08:31:42 -07:00
sunrpc svcrpc: sends on closed socket should stop immediately 2012-09-14 10:00:19 -07:00
tipc tipc: Optimize setting of immutable payload message header fields 2012-02-29 11:45:35 -05:00
unix poll: add poll_requested_events() and poll_does_not_wait() functions 2012-03-23 16:58:38 -07:00
wanrouter wanmain: comparing array with NULL 2012-08-09 08:31:51 -07:00
wimax
wireless cfg80211: fix interface combinations check for ADHOC(IBSS) 2012-08-15 08:10:33 -07:00
x25 net:x25: use IS_ENABLED 2011-12-16 15:49:52 -05:00
xfrm ipv6: fix incorrect ipsec fragment 2012-06-10 00:36:15 +09:00
compat.c net: Fix references to out-of-scope variables in put_cmsg_compat() 2012-08-09 08:31:42 -07:00
Kconfig net: Add Open vSwitch kernel components. 2011-12-03 09:35:17 -08:00
Makefile net: Add Open vSwitch kernel components. 2011-12-03 09:35:17 -08:00
nonet.c
socket.c Fix order of arguments to compat_put_time[spec|val] 2012-09-14 10:00:23 -07:00
sysctl_net.c sysctl: Modify __register_sysctl_paths to take a set instead of a root and an nsproxy 2012-01-24 16:40:30 -08:00