Hannes Frederic Sowa dcf5c5397a net: add validation for the socket syscall protocol argument ... 郭永刚 reported that one could simply crash the kernel as root by using a simple program: int socket_fd; struct sockaddr_in addr; addr.sin_port = 0; addr.sin_addr.s_addr = INADDR_ANY; addr.sin_family = 10; socket_fd = socket(10,3,0x40000000); connect(socket_fd , &addr,16); AF_INET, AF_INET6 sockets actually only support 8-bit protocol identifiers. inet_sock's skc_protocol field thus is sized accordingly, thus larger protocol identifiers simply cut off the higher bits and store a zero in the protocol fields. This could lead to e.g. NULL function pointer because as a result of the cut off inet_num is zero and we call down to inet_autobind, which is NULL for raw sockets. kernel: Call Trace: kernel: [<ffffffff816db90e>] ? inet_autobind+0x2e/0x70 kernel: [<ffffffff816db9a4>] inet_dgram_connect+0x54/0x80 kernel: [<ffffffff81645069>] SYSC_connect+0xd9/0x110 kernel: [<ffffffff810ac51b>] ? ptrace_notify+0x5b/0x80 kernel: [<ffffffff810236d8>] ? syscall_trace_enter_phase2+0x108/0x200 kernel: [<ffffffff81645e0e>] SyS_connect+0xe/0x10 kernel: [<ffffffff81779515>] tracesys_phase2+0x84/0x89 I found no particular commit which introduced this problem. Change-Id: I653fad90da54908144cc8916c2dccb1fa6f14eed CVE: CVE-2015-8543 Cc: Cong Wang <cwang@twopensource.com> Reported-by: 郭永刚 <guoyonggang@360.cn> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-10-29 23:12:11 +08:00
..
ircomm	TTY: remove unneeded tty->index checks	2012-03-08 11:42:21 -08:00
irlan	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
irnet	ppp: Replace uses of <linux/if_ppp.h> with <linux/ppp-ioctl.h>	2012-03-04 20:41:38 -05:00
af_irda.c	net: add validation for the socket syscall protocol argument	2016-10-29 23:12:11 +08:00
discovery.c
irda_device.c
iriap.c
iriap_event.c
irias_object.c
irlap.c
irlap_event.c
irlap_frame.c
irlmp.c
irlmp_event.c
irlmp_frame.c
irmod.c
irnetlink.c
irproc.c
irqueue.c
irsysctl.c
irttp.c	irttp: Use kmemdup rather than duplicating its implementation	2011-11-21 15:02:17 -05:00
Kconfig
Makefile
parameters.c
qos.c
timer.c	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
wrapper.c