Haimin Zhang c1337f8ea8 net/ieee802154: fix uninit value bug in dgram_sendmsg ...

[ Upstream commit 94160108a7 ]

There is uninit value bug in dgram_sendmsg function in
net/ieee802154/socket.c when the length of valid data pointed by the
msg->msg_name isn't verified.

We introducing a helper function ieee802154_sockaddr_check_size to
check namelen. First we check there is addr_type in ieee802154_addr_sa.
Then, we check namelen according to addr_type.

Also fixed in raw_bind, dgram_bind, dgram_connect.

Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2022-10-15 07:55:52 +02:00

..

9p

…

bluetooth

Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put

2022-08-03 12:00:43 +02:00

caif

net: caif: add proper error handling

2021-06-10 13:39:24 +02:00

iucv

…

netfilter

netfilter: nf_tables: disallow jump to implicit chain from set element

2022-08-31 17:15:18 +02:00

netns

xfrm: rework default policy structure

2022-05-25 09:17:58 +02:00

nfc

NFC: add NCI_UNREG flag to eliminate the race

2021-11-26 10:39:18 +01:00

phonet

…

sctp

sctp: use call_rcu to free endpoint

2022-01-05 12:40:30 +01:00

tc_act

net/sched: act_pedit: really ensure the skb is writable

2022-05-18 10:23:44 +02:00

6lowpan.h

…

act_api.h

net: sched: fix err handler in tcf_action_init()

2021-04-14 08:42:05 +02:00

addrconf.h

ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr

2022-08-03 12:00:46 +02:00

af_ieee802154.h

…

af_rxrpc.h

…

af_unix.h

…

af_vsock.h

vsock: each transport cycles only on its own sockets

2022-03-23 09:13:27 +01:00

ah.h

…

arp.h

ipv4: Invalidate neighbour for broadcast address upon address addition

2022-04-13 21:00:57 +02:00

atmclip.h

…

ax25.h

ax25: fix reference count leaks of ax25_dev

2022-04-20 09:23:31 +02:00

ax88796.h

…

bareudp.h

…

bond_3ad.h

net: bonding: Share lacpdu_mcast_addr definition

2022-09-28 11:10:31 +02:00

bond_alb.h

bonding: make tx_rebalance_counter an atomic

2021-12-14 11:32:36 +01:00

bond_options.h

…

bonding.h

net: bonding: Share lacpdu_mcast_addr definition

2022-09-28 11:10:31 +02:00

bpf_sk_storage.h

…

busy_poll.h

net: Fix a data-race around sysctl_net_busy_poll.

2022-08-31 17:15:20 +02:00

calipso.h

…

cfg80211-wext.h

…

cfg80211.h

cfg80211: fix management registrations locking

2021-11-02 19:48:20 +01:00

cfg802154.h

…

checksum.h

net: Force inlining of checksum functions in net/checksum.h

2022-03-02 11:42:50 +01:00

cipso_ipv4.h

…

cls_cgroup.h

…

codel_impl.h

…

codel_qdisc.h

…

codel.h

…

compat.h

…

datalink.h

…

dcbevent.h

…

dcbnl.h

…

devlink.h

…

dn_dev.h

…

dn_fib.h

…

dn_neigh.h

…

dn_nsp.h

…

dn_route.h

…

dn.h

…

dsa.h

…

dsfield.h

…

dst_cache.h

wireguard: device: reset peer src endpoint when netns exits

2021-12-08 09:03:22 +01:00

dst_metadata.h

net: fix a memleak when uncloning an skb dst and its metadata

2022-02-16 12:54:26 +01:00

dst_ops.h

…

dst.h

net: Consolidate common blackhole dst ops

2021-03-30 14:32:05 +02:00

erspan.h

…

esp.h

esp: limit skb_page_frag_refill use to a single page

2022-04-27 13:53:48 +02:00

espintcp.h

…

ethoc.h

…

failover.h

…

fib_notifier.h

…

fib_rules.h

ipv6: fix memory leak in fib6_rule_suppress

2021-12-08 09:03:21 +01:00

firewire.h

…

flow_dissector.h

net/sched: flower: fix parsing of ethertype following VLAN header

2022-04-20 09:23:11 +02:00

flow_offload.h

netfilter: nf_tables: bail out early if hardware offload is not supported

2022-06-14 18:32:40 +02:00

flow.h

lsm,selinux: pass flowi_common instead of flowi to the LSM hooks

2022-06-09 10:21:09 +02:00

fou.h

…

fq_impl.h

…

fq.h

…

garp.h

…

gen_stats.h

…

genetlink.h

…

geneve.h

…

gre.h

…

gro_cells.h

…

gtp.h

…

gue.h

…

hwbm.h

…

icmp.h

net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending

2021-03-04 11:38:46 +01:00

ieee80211_radiotap.h

…

ieee802154_netdev.h

net/ieee802154: fix uninit value bug in dgram_sendmsg

2022-10-15 07:55:52 +02:00

if_inet6.h

ipv6: fix locking issues with loops over idev->addr_list

2022-06-09 10:20:50 +02:00

ife.h

…

ila.h

…

inet6_connection_sock.h

…

inet6_hashtables.h

net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set

2022-08-21 15:15:51 +02:00

inet_common.h

…

inet_connection_sock.h

Revert "tcp: change pingpong threshold to 3"

2022-08-03 12:00:45 +02:00

inet_ecn.h

…

inet_frag.h

inet: frags: annotate races around fqdir->dead and fqdir->high_thresh

2022-01-27 10:54:33 +01:00

inet_hashtables.h

net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set

2022-08-21 15:15:51 +02:00

inet_sock.h

net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set

2022-08-21 15:15:51 +02:00

inet_timewait_sock.h

…

inetpeer.h

…

ip6_checksum.h

…

ip6_fib.h

ipv6: annotate accesses to fn->fn_sernum

2022-02-01 17:25:44 +01:00

ip6_route.h

net: ipv6: fix returned variable type in ip6_skb_dst_mtu

2021-08-12 13:22:07 +02:00

ip6_tunnel.h

ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode

2022-05-09 09:05:04 +02:00

ip_fib.h

ipv4: convert fib_num_tclassid_users to atomic_t

2021-12-08 09:03:26 +01:00

ip_tunnels.h

ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode

2022-05-09 09:05:04 +02:00

ip_vs.h

…

ip.h

ip: Fix data-races around sysctl_ip_prot_sock.

2022-07-29 17:19:20 +02:00

ipcomp.h

…

ipconfig.h

…

ipv6_frag.h

inet: frags: annotate races around fqdir->dead and fqdir->high_thresh

2022-01-27 10:54:33 +01:00

ipv6_stubs.h

net: ipv6: add fib6_nh_release_dsts stub

2021-12-01 09:19:05 +01:00

ipv6.h

ipv6: per-netns exclusive flowlabel checks

2022-02-23 12:01:01 +01:00

ipx.h

…

iw_handler.h

…

kcm.h

…

l3mdev.h

…

lag.h

…

lapb.h

…

lib80211.h

…

llc_c_ac.h

…

llc_c_ev.h

…

llc_c_st.h

…

llc_conn.h

…

llc_if.h

…

llc_pdu.h

net: llc: fix skb_over_panic

2021-08-04 12:46:43 +02:00

llc_s_ac.h

…

llc_s_ev.h

…

llc_s_st.h

…

llc_sap.h

…

llc.h

llc: fix out-of-bound array index in llc_sk_dev_hash()

2021-11-18 14:04:27 +01:00

lwtunnel.h

…

mac80211.h

mac80211: Fix NULL ptr deref for injected rate info

2021-06-23 14:42:52 +02:00

mac802154.h

…

macsec.h

net: macsec: fix the length used to copy the key for offloading

2021-07-14 16:56:28 +02:00

mip6.h

…

mld.h

…

mpls_iptunnel.h

…

mpls.h

…

mptcp.h

…

mrp.h

…

ncsi.h

…

ndisc.h

…

neighbour.h

net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE

2021-11-18 14:04:29 +01:00

net_failover.h

…

net_namespace.h

net: make get_net_ns return error if NET_NS is disabled

2021-06-23 14:42:44 +02:00

net_ratelimit.h

…

netevent.h

…

netlabel.h

…

netlink.h

…

netprio_cgroup.h

…

netrom.h

…

nexthop.h

net: ipv4: Fix rtnexthop len when RTA_FLOW is present

2021-10-06 15:55:53 +02:00

nl802154.h

net: ieee802154: handle iftypes as u32

2021-12-01 09:19:03 +01:00

nsh.h

…

p8022.h

…

page_pool.h

mm: fix struct page layout on 32-bit systems

2021-05-19 10:13:17 +02:00

pie.h

…

ping.h

…

pkt_cls.h

net: zero-initialize tc skb extension on allocation

2021-06-03 09:00:51 +02:00

pkt_sched.h

net: prevent user from passing illegal stab size

2021-10-17 10:43:33 +02:00

pptp.h

…

protocol.h

…

psample.h

psample: Add a fwd declaration for skbuff

2021-08-18 08:59:11 +02:00

psnap.h

…

raw.h

raw: Fix a data-race around sysctl_raw_l3mdev_accept.

2022-07-21 21:20:10 +02:00

rawv6.h

…

red.h

sch_red: fix off-by-one checks in red_check_params()

2021-04-14 08:42:07 +02:00

regulatory.h

…

request_sock.h

…

rose.h

…

route.h

lsm,selinux: pass flowi_common instead of flowi to the LSM hooks

2022-06-09 10:21:09 +02:00

rpl.h

…

rsi_91x.h

…

rtnetlink.h

can: dev: Move device back to init netns on owning netns delete

2021-03-30 14:32:08 +02:00

rtnh.h

…

sch_generic.h

net: sched: add barrier to fix packet stuck problem for lockless qdisc

2022-06-14 18:32:36 +02:00

scm.h

…

secure_seq.h

secure_seq: use the 64 bits of the siphash for port offset calculation

2022-05-30 09:33:23 +02:00

seg6_hmac.h

…

seg6_local.h

…

seg6.h

…

slhc_vj.h

…

smc.h

…

snmp.h

…

sock_reuseport.h

…

sock.h

net: fix refcount bug in sk_psock_get (2)

2022-09-05 10:28:56 +02:00

Space.h

…

stp.h

…

strparser.h

bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding

2021-11-18 14:04:27 +01:00

switchdev.h

switchdev: mrp: Remove SWITCHDEV_ATTR_ID_MRP_PORT_STAT

2021-02-17 11:02:29 +01:00

tcp_states.h

…

tcp.h

tcp: Fix a data-race around sysctl_tcp_adv_win_scale.

2022-08-03 12:00:44 +02:00

timewait_sock.h

…

tipc.h

…

tls_toe.h

…

tls.h

net/tls: Check for errors in tls_device_init

2022-07-21 21:20:13 +02:00

transp_v6.h

…

tso.h

…

tun_proto.h

…

udp_tunnel.h

udp: call udp_encap_enable for v6 sockets when enabling encap

2022-04-08 14:39:54 +02:00

udp.h

udp: Fix a data-race around sysctl_udp_l3mdev_accept.

2022-07-29 17:19:21 +02:00

udplite.h

…

vsock_addr.h

…

vxlan.h

…

wext.h

…

wimax.h

…

x25.h

…

x25device.h

…

xdp_priv.h

…

xdp_sock_drv.h

…

xdp_sock.h

…

xdp.h

…

xfrm.h

xfrm: fix "disable_policy" flag use when arriving from different devices

2022-05-25 09:17:58 +02:00

xsk_buff_pool.h

xsk: Inherit need_wakeup flag for shared sockets

2022-10-15 07:55:51 +02:00