Eric Dumazet 77125815f0 net: avoid signed overflows for SO_{SND|RCV}BUFFORCE ...

[ Upstream commit b98b0bc8c4 ]

CAP_NET_ADMIN users should not be allowed to set negative
sk_sndbuf or sk_rcvbuf values, as it can lead to various memory
corruptions, crashes, OOM...

Note that before commit 8298193012 ("net: cleanups in
sock_setsockopt()"), the bug was even more serious, since SO_SNDBUF
and SO_RCVBUF were vulnerable.

This needs to be backported to all known linux kernels.

Again, many thanks to syzkaller team for discovering this gem.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2016-12-10 19:07:24 +01:00

..

datagram.c

net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA

2015-12-01 15:45:05 -05:00

dev_addr_lists.c

net: fix spelling for synchronized

2014-11-18 15:26:32 -05:00

dev_ioctl.c

dev_ioctl: use sizeof(x) instead of sizeof x

2014-11-18 15:27:32 -05:00

dev.c

net: mangle zero checksum in skb_checksum_help()

2016-11-21 10:06:39 +01:00

drop_monitor.c

net: Replace get_cpu_var through this_cpu_ptr

2014-08-26 13:45:47 -04:00

dst.c

net: possible use after free in dst_release

2016-01-06 15:00:27 -05:00

ethtool.c

ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings

2015-10-14 19:00:20 -07:00

fib_rules.c

fib_rules: fix fib rule dumps across multiple skbs

2015-09-24 15:21:54 -07:00

filter.c

tcp: take care of truncations done by sk_filter()

2016-11-21 10:06:40 +01:00

flow_dissector.c

flow_dissect: call init_default_flow_dissectors() earlier

2016-12-02 09:09:02 +01:00

flow.c

flow: Move __get_hash_from_flowi{4,6} into flow_dissector.c

2015-09-01 17:00:24 -07:00

gen_estimator.c

net_sched: gen_estimator: extend pps limit

2015-07-08 13:59:20 -07:00

gen_stats.c

gen_stats.c: Duplicate xstats buffer for later use

2015-02-19 15:45:53 -05:00

link_watch.c

dev: introduce dev_get_iflink()

2015-04-02 14:04:59 -04:00

lwtunnel.c

dst: Pass net into dst->output

2015-10-08 04:27:03 -07:00

Makefile

lwtunnel: infrastructure for handling light weight tunnels like mpls

2015-07-21 10:39:03 -07:00

neighbour.c

neigh: Explicitly declare RCU-bh read side critical section in neigh_xmit()

2016-07-11 09:31:12 -07:00

net_namespace.c

net: check dead netns for peernet2id_alloc()

2016-12-10 19:07:22 +01:00

net-procfs.c

rps: selective flow shedding during softnet overflow

2013-05-20 13:48:04 -07:00

net-sysfs.c

switchdev: rename SWITCHDEV_ATTR_* enum values to SWITCHDEV_ATTR_ID_*

2015-10-03 04:49:37 -07:00

net-sysfs.h

net: netdev_kobject_init: annotate with __init

2014-01-05 20:27:54 -05:00

net-traces.c

net: FIB tracepoints

2015-08-29 13:05:16 -07:00

netclassid_cgroup.c

Merge branch 'master' into for-4.4-fixes

2015-12-07 10:09:03 -05:00

netevent.c

netevent: remove automatic variable in register_netevent_notifier()

2015-05-31 00:03:21 -07:00

netpoll.c

netpoll: Drop budget parameter from NAPI polling call hierarchy

2015-09-29 14:57:16 -07:00

netprio_cgroup.c

cgroup: fix handling of multi-destination migration from subtree_control enabling

2015-12-03 10:18:21 -05:00

pktgen.c

net: pktgen: remove rcu locking in pktgen_change_name()

2016-11-15 07:46:38 +01:00

ptp_classifier.c

ptp: Change ptp_class to a proper bitmask

2015-11-03 11:08:22 -05:00

request_sock.c

tcp: restore fastopen operations

2015-10-05 03:19:06 -07:00

rtnetlink.c

rtnetlink: fix FDB size computation

2016-12-10 19:07:22 +01:00

scm.c

unix: correctly track in-flight fds in sending process user_struct

2016-03-03 15:07:05 -08:00

secure_seq.c

net: remove a sparse error in secure_dccpv6_sequence_number()

2015-05-25 22:55:37 -04:00

skbuff.c

net_sched: fix mirrored packets checksum

2016-07-27 09:47:31 -07:00

sock_diag.c

net/core: make sock_diag.c explicitly non-modular

2015-10-09 07:52:27 -07:00

sock.c

net: avoid signed overflows for SO_{SND|RCV}BUFFORCE

2016-12-10 19:07:24 +01:00

stream.c

net: fix sock_wake_async() rcu protection

2015-12-01 15:45:05 -05:00

sysctl_net_core.c

net:Add sysctl_max_skb_frags

2016-03-03 15:07:05 -08:00

timestamping.c

net: skb_defer_rx_timestamp should check for phydev before setting up classify

2015-07-09 14:17:15 -07:00

tso.c

net: tso: add support for IPv6

2015-10-26 22:24:22 -07:00

utils.c

net: move net_get_random_once to lib

2015-10-08 05:26:35 -07:00