TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
v4.9.150
twx-linux/net
T
History
Dominique Martinet 00f0194cfe 9p/net: put a lower bound on msize 
commit 574d356b7a upstream.

If the requested msize is too small (either from command line argument
or from the server version reply), we won't get any work done.
If it's *really* too small, nothing will work, and this got caught by
syzbot recently (on a new kmem_cache_create_usercopy() call)

Just set a minimum msize to 4k in both code paths, until someone
complains they have a use-case for a smaller msize.

We need to check in both mount option and server reply individually
because the msize for the first version request would be unchecked
with just a global check on clnt->msize.

Link: http://lkml.kernel.org/r/1541407968-31350-1-git-send-email-asmadeus@codewreck.org
Reported-by: syzbot+0c1d61e4db7db94102ca@syzkaller.appspotmail.com
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
Cc: Eric Van Hensbergen <ericvh@gmail.com>
Cc: Latchesar Ionkov <lucho@ionkov.net>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-13 10:03:52 +01:00
..
6lowpan
6lowpan: iphc: reset mac_header after decompress to fix panic
2018-10-03 17:01:42 -07:00
9p
9p/net: put a lower bound on msize
2019-01-13 10:03:52 +01:00
802
…
8021q
vlan: also check phy_driver ts_info for vlan's real device
2018-04-13 19:48:34 +02:00
appletalk
…
atm
net: atm: Fix potential Spectre v1
2018-05-16 10:08:44 +02:00
ax25
ax25: fix a use-after-free in ax25_fillin_cb()
2019-01-09 16:16:39 +01:00
batman-adv
batman-adv: Expand merged fragment buffer for full packet
2018-12-13 09:20:25 +01:00
bluetooth
Bluetooth: SMP: fix crash in unpairing
2018-11-10 07:42:42 -08:00
bridge
net: bridge: remove ipv6 zero address check in mcast queries
2018-11-10 07:42:57 -08:00
caif
net: caif: Add a missing rcu_read_unlock() in caif_flow_cb
2018-09-05 09:20:00 +02:00
can
…
ceph
libceph: fix CEPH_FEATURE_CEPHX_V2 check in calc_signature()
2019-01-13 10:03:50 +01:00
core
sock: Make sock->sk_stamp thread-safe
2019-01-09 16:16:41 +01:00
dcb
net: dcb: For wild-card lookups, use priority -1, not 0
2018-09-19 22:47:15 +02:00
dccp
inet: make sure to grab rcu_read_lock before using ireq->ireq_opt
2018-10-18 09:13:23 +02:00
decnet
…
dns_resolver
KEYS: DNS: fix parsing multiple options
2018-07-22 14:27:39 +02:00
dsa
net: dsa: Do not suspend/resume closed slave_dev
2018-08-06 16:23:03 +02:00
ethernet
…
hsr
hsr: fix incorrect warning
2018-04-13 19:48:29 +02:00
ieee802154
ieee802154: lowpan_header_create check must check daddr
2019-01-09 16:16:40 +01:00
ipv4
net: ipv4: do not handle duplicate fragments as overlapping
2019-01-09 16:16:40 +01:00
ipv6
ipv6: tunnels: fix two use-after-free
2019-01-09 16:16:40 +01:00
ipx
…
irda
irda: Only insert new objects into the global database via setsockopt
2018-09-15 09:43:01 +02:00
iucv
net/iucv: Free memory obtained by kzalloc
2018-03-31 18:11:34 +02:00
kcm
kcm: Fix use-after-free caused by clonned sockets
2018-06-13 16:16:42 +02:00
key
af_key: Always verify length of provided sadb_key
2018-06-16 09:52:32 +02:00
l2tp
l2tp: remove configurable payload offset
2018-11-10 07:42:54 -08:00
l3mdev
…
lapb
…
llc
llc: do not use sk_eat_skb()
2018-12-01 09:44:19 +01:00
mac80211
mac80211: Fix condition validating WMM IE
2018-12-21 14:11:32 +01:00
mac802154
net: mac802154: tx: expand tailroom if necessary
2018-09-09 20:01:19 +02:00
mpls
mpls, nospec: Sanitize array index in mpls_label_ok()
2018-03-11 16:21:34 +01:00
ncsi
…
netfilter
netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
2019-01-13 10:03:48 +01:00
netlabel
netlabel: check for IPV4MASK in addrinfo_get
2018-10-18 09:13:22 +02:00
netlink
netlink: Don't shift on 64 for ngroups
2018-08-09 12:17:59 +02:00
netrom
netrom: fix locking in nr_find_socket()
2019-01-09 16:16:40 +01:00
nfc
NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
2018-09-29 03:07:30 -07:00
openvswitch
openvswitch: Remove padding from packet before L3+ conntrack processing
2018-05-30 07:50:23 +02:00
packet
packet: validate address length if non-zero
2019-01-09 16:16:40 +01:00
phonet
…
qrtr
net: qrtr: Broadcast messages only from control port
2018-08-24 13:12:36 +02:00
rds
rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp
2018-11-10 07:42:50 -08:00
rfkill
rfkill: gpio: fix memory leak in probe error path
2018-05-16 10:08:43 +02:00
rose
…
rxrpc
rxrpc: Only take the rwind and mtu values from latest ACK
2018-11-10 07:42:56 -08:00
sched
net: Prevent invalid access to skb->prev in __qdisc_drop_all
2018-12-17 09:38:31 +01:00
sctp
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
2019-01-09 16:16:40 +01:00
strparser
strparser: Fix incorrect strp->need_bytes value.
2018-04-29 11:32:02 +02:00
sunrpc
sunrpc: use SVC_NET() in svcauth_gss_* functions
2019-01-13 10:03:51 +01:00
switchdev
…
tipc
tipc: compare remote and local protocols in tipc_udp_enable()
2019-01-09 16:16:41 +01:00
unix
…
vmw_vsock
VSOCK: Send reset control packet when socket is partially bound
2019-01-09 16:16:41 +01:00
wimax
…
wireless
nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT
2018-11-10 07:42:42 -08:00
x25
net: x25: fix one potential use-after-free issue
2018-04-13 19:48:00 +02:00
xfrm
xfrm: Fix bucket count reported to userspace
2019-01-13 10:03:48 +01:00
compat.c
sock: Make sock->sk_stamp thread-safe
2019-01-09 16:16:41 +01:00
Kconfig
…
Makefile
…
socket.c
net: socket: fix a missing-check bug
2018-11-10 07:42:58 -08:00
sysctl_net.c
…