Sasha Levin bcf1b70ac6 phonet: Check input from user before allocating ... A phonet packet is limited to USHRT_MAX bytes, this is never checked during tx which means that the user can specify any size he wishes, and the kernel will attempt to allocate that size. In the good case, it'll lead to the following warning, but it may also cause the kernel to kick in the OOM and kill a random task on the server. [ 8921.744094] WARNING: at mm/page_alloc.c:2255 __alloc_pages_slowpath+0x65/0x730() [ 8921.749770] Pid: 5081, comm: trinity Tainted: G W 3.4.0-rc1-next-20120402-sasha #46 [ 8921.756672] Call Trace: [ 8921.758185] [<ffffffff810b2ba7>] warn_slowpath_common+0x87/0xb0 [ 8921.762868] [<ffffffff810b2be5>] warn_slowpath_null+0x15/0x20 [ 8921.765399] [<ffffffff8117eae5>] __alloc_pages_slowpath+0x65/0x730 [ 8921.769226] [<ffffffff81179c8a>] ? zone_watermark_ok+0x1a/0x20 [ 8921.771686] [<ffffffff8117d045>] ? get_page_from_freelist+0x625/0x660 [ 8921.773919] [<ffffffff8117f3a8>] __alloc_pages_nodemask+0x1f8/0x240 [ 8921.776248] [<ffffffff811c03e0>] kmalloc_large_node+0x70/0xc0 [ 8921.778294] [<ffffffff811c4bd4>] __kmalloc_node_track_caller+0x34/0x1c0 [ 8921.780847] [<ffffffff821b0e3c>] ? sock_alloc_send_pskb+0xbc/0x260 [ 8921.783179] [<ffffffff821b3c65>] __alloc_skb+0x75/0x170 [ 8921.784971] [<ffffffff821b0e3c>] sock_alloc_send_pskb+0xbc/0x260 [ 8921.787111] [<ffffffff821b002e>] ? release_sock+0x7e/0x90 [ 8921.788973] [<ffffffff821b0ff0>] sock_alloc_send_skb+0x10/0x20 [ 8921.791052] [<ffffffff824cfc20>] pep_sendmsg+0x60/0x380 [ 8921.792931] [<ffffffff824cb4a6>] ? pn_socket_bind+0x156/0x180 [ 8921.794917] [<ffffffff824cb50f>] ? pn_socket_autobind+0x3f/0x90 [ 8921.797053] [<ffffffff824cb63f>] pn_socket_sendmsg+0x4f/0x70 [ 8921.798992] [<ffffffff821ab8e7>] sock_aio_write+0x187/0x1b0 [ 8921.801395] [<ffffffff810e325e>] ? sub_preempt_count+0xae/0xf0 [ 8921.803501] [<ffffffff8111842c>] ? __lock_acquire+0x42c/0x4b0 [ 8921.805505] [<ffffffff821ab760>] ? __sock_recv_ts_and_drops+0x140/0x140 [ 8921.807860] [<ffffffff811e07cc>] do_sync_readv_writev+0xbc/0x110 [ 8921.809986] [<ffffffff811958e7>] ? might_fault+0x97/0xa0 [ 8921.811998] [<ffffffff817bd99e>] ? security_file_permission+0x1e/0x90 [ 8921.814595] [<ffffffff811e17e2>] do_readv_writev+0xe2/0x1e0 [ 8921.816702] [<ffffffff810b8dac>] ? do_setitimer+0x1ac/0x200 [ 8921.818819] [<ffffffff810e2ec1>] ? get_parent_ip+0x11/0x50 [ 8921.820863] [<ffffffff810e325e>] ? sub_preempt_count+0xae/0xf0 [ 8921.823318] [<ffffffff811e1926>] vfs_writev+0x46/0x60 [ 8921.825219] [<ffffffff811e1a3f>] sys_writev+0x4f/0xb0 [ 8921.827127] [<ffffffff82658039>] system_call_fastpath+0x16/0x1b [ 8921.829384] ---[ end trace dffe390f30db9eb7 ]--- Signed-off-by: Sasha Levin <levinsasha928@gmail.com> Acked-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2012-04-05 19:05:56 -04:00
..
9p	net/9p: handle flushed Tclunk/Tremove	2012-02-26 14:49:57 -06:00
802	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2012-04-02 17:53:39 -07:00
8021q
appletalk
atm	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
ax25	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
batman-adv	Merge tag 'batman-adv-for-davem' of git://git.open-mesh.org/linux-merge	2012-03-11 15:36:34 -07:00
bluetooth	Merge branch 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2012-03-29 18:12:23 -07:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2012-03-09 14:34:20 -08:00
caif	caif: make zero a legal caif connetion id.	2012-03-11 15:38:16 -07:00
can
ceph	libceph: isolate kmap() call in write_partial_msg_pages()	2012-03-22 10:47:52 -05:00
core	bpf jit: Make the filter.c::__load_pointer helper non-static for the jits	2012-04-03 18:01:03 -04:00
dcb
dccp	dccp: fix bug in sequence number validation during connection setup	2012-03-03 09:02:52 -07:00
decnet	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
dns_resolver
dsa
econet	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
ethernet	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
ieee802154	net/ieee802154/6lowpan.c: reuse eth_mac_addr()	2012-02-22 14:46:37 -05:00
ipv4	tcp: tcp_sendpages() should call tcp_push() once	2012-04-05 19:04:27 -04:00
ipv6	ipv6: fix array index in ip6_mc_add_src()	2012-04-05 00:00:42 -04:00
ipx
irda	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
iucv	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux	2012-03-22 18:15:32 -07:00
key
l2tp	l2tp: enable automatic module loading for l2tp_ppp	2012-03-21 22:14:56 -04:00
lapb	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
llc
mac80211	mac80211: fix oper channel timestamp updation	2012-03-28 14:25:37 -04:00
netfilter	netfilter: nf_conntrack: fix count leak in error path of __nf_conntrack_alloc	2012-04-03 19:20:30 -04:00
netlabel	netlabel: use GFP flags from caller instead of GFP_ATOMIC	2012-03-22 19:29:57 -04:00
netlink	netlink: allow to pass data pointer to netlink_dump_start() callback	2012-02-26 14:10:44 -05:00
netrom	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
nfc	NFC: NCI code identation fixes	2012-03-06 15:16:25 -05:00
openvswitch	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
packet	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
phonet	phonet: Check input from user before allocating	2012-04-05 19:05:56 -04:00
rds	RDS: use gfp flags from caller in conn_alloc()	2012-03-22 19:29:58 -04:00
rfkill	device.h: cleanup users outside of linux/include (C files)	2012-03-11 14:27:37 -04:00
rose	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2012-04-02 17:53:39 -07:00
rxrpc	RxRPC: Fix kcalloc parameters swapped	2012-02-14 14:41:55 -05:00
sched	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2012-03-20 21:04:47 -07:00
sctp	sctp: Allow struct sctp_event_subscribe to grow without breaking binaries	2012-04-04 18:05:02 -04:00
sunrpc	Merge branch 'for-3.4' of git://linux-nfs.org/~bfields/linux	2012-03-29 14:53:25 -07:00
tipc	tipc: Optimize setting of immutable payload message header fields	2012-02-29 11:45:35 -05:00
unix	poll: add poll_requested_events() and poll_does_not_wait() functions	2012-03-23 16:58:38 -07:00
wanrouter
wimax
wireless	cfg80211: allow CFG80211_SIGNAL_TYPE_UNSPEC in station_info	2012-03-26 15:07:25 -04:00
x25
xfrm	xfrm: Access the replay notify functions via the registered callbacks	2012-03-22 19:29:58 -04:00
compat.c	Merge branch 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2012-03-29 18:12:23 -07:00
Kconfig
Makefile
nonet.c
socket.c	tcp: tcp_sendpages() should call tcp_push() once	2012-04-05 19:04:27 -04:00
sysctl_net.c