android_kernel_google_msm/net
Mathias Krause 70b7bcbb46 sock_diag: Fix out-of-bounds access to sock_diag_handlers[]
Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
with a family greater or equal then AF_MAX -- the array size of
sock_diag_handlers[]. The current code does not test for this
condition therefore is vulnerable to an out-of-bound access opening
doors for a privilege escalation.

CRs-fixed: 519050
Change-Id: I1466c4f56f3f4df90cf8a1ae17afa80c89b813e8
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Git-commit: 6e601a5356
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>
2013-09-04 23:51:27 -07:00
..
9p
802 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2012-04-02 17:53:39 -07:00
8021q Revert "net: maintain namespace isolation between vlan and real device" 2012-05-10 23:03:34 -04:00
appletalk
atm Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
ax25 net ax25: Reorder ax25_exit to remove races. 2012-04-19 15:37:48 -04:00
batman-adv Merge tag 'batman-adv-for-davem' of git://git.open-mesh.org/linux-merge 2012-03-11 15:36:34 -07:00
bluetooth Revert "Bluetooth: Avoid re-authentication for secure high connections" 2013-03-15 17:08:19 -07:00
bridge Merge commit 'v3.4-rc6' into android-3.4 2012-05-07 18:20:34 -07:00
caif caif: Fix memory leakage in the chnl_net.c. 2012-04-13 11:01:44 -04:00
can
ceph libceph: isolate kmap() call in write_partial_msg_pages() 2012-03-22 10:47:52 -05:00
core sock_diag: Fix out-of-bounds access to sock_diag_handlers[] 2013-09-04 23:51:27 -07:00
dcb
dccp
decnet Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
dns_resolver
dsa
econet Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
ethernet Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
ieee802154 6lowpan: add missing spin_lock_init() 2012-04-26 05:32:55 -04:00
ipv4 tcp: fix FIONREAD/SIOCINQ 2013-05-29 12:43:30 -07:00
ipv6 net: ipv6: Don't purge default router if accept_ra=2 2013-04-18 16:08:06 -07:00
ipx
irda Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
iucv Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2012-03-22 18:15:32 -07:00
key net/key/af_key.c: add missing kfree_skb 2012-04-13 11:01:44 -04:00
l2tp net: l2tp: unlock socket lock before returning from l2tp_ip_sendmsg 2012-05-02 21:04:33 -04:00
lapb Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
llc
mac80211 mac80211: fix AP mode EAP tx for VLAN stations 2012-04-30 14:40:05 -04:00
netfilter netfilter: qtaguid: rate limit some of the printks 2013-04-18 16:08:43 -07:00
netlabel netlabel: use GFP flags from caller instead of GFP_ATOMIC 2012-03-22 19:29:57 -04:00
netlink netlink: validate addr_len on bind 2013-07-03 10:34:22 -07:00
netrom Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
nfc NFC: Fix the LLCP Tx fragmentation loop 2012-04-11 15:09:33 -04:00
openvswitch openvswitch: checking wrong variable in queue_userspace_packet() 2012-05-13 15:47:34 -04:00
packet Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
phonet phonet: Sort out initiailziation and cleanup code. 2012-04-13 11:01:43 -04:00
rds RDS: use gfp flags from caller in conn_alloc() 2012-03-22 19:29:58 -04:00
rfkill rfkill: Introduce CONFIG_RFKILL_PM and use instead of CONFIG_PM to power down 2012-04-09 13:57:48 -07:00
rose Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2012-04-02 17:53:39 -07:00
rxrpc
sched net: sched: export an api to enable/disable flow on sch 2013-03-07 15:20:04 -08:00
sctp sctp: check cached dst before using it 2012-05-10 23:15:47 -04:00
sunrpc auth_gss: the list of pseudoflavors not being parsed correctly 2012-05-03 12:35:33 -04:00
tipc
unix af_netlink: force credentials passing [CVE-2012-3520] 2013-03-04 12:46:00 -08:00
wanrouter
wimax
wireless update net/wireless/db.txt 2013-05-16 15:16:13 -07:00
x25
xfrm xfrm: Access the replay notify functions via the registered callbacks 2012-03-22 19:29:58 -04:00
Kconfig net: Fix CONFIG_RPS option to be turned off 2012-04-09 13:57:51 -07:00
Makefile net: activity_stats: Add statistics for network transmission activity 2012-04-09 13:57:50 -07:00
activity_stats.c net: activity_stats: Add statistics for network transmission activity 2012-04-09 13:57:50 -07:00
compat.c Merge branch 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2012-03-29 18:12:23 -07:00
nonet.c
socket.c tcp: tcp_sendpages() should call tcp_push() once 2012-04-05 19:04:27 -04:00
sysctl_net.c