forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
linux-pinenote/net/x25
History
andrew hendry 95c3043008 x25: possible skb leak on bad facilities 
Originally x25_parse_facilities returned
-1 for an error
 0 meaning 0 length facilities
>0 the length of the facilities parsed.

5ef41308f9 ("x25: Prevent crashing when parsing bad X.25 facilities") introduced more
error checking in x25_parse_facilities however used 0 to indicate bad parsing
a6331d6f9a ("memory corruption in X.25 facilities parsing") followed this further for
DTE facilities, again using 0 for bad parsing.

The meaning of 0 got confused in the callers.
If the facilities are messed up we can't determine where the data starts.
So patch makes all parsing errors return -1 and ensures callers close and don't use the skb further.

Reported-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Andrew Hendry <andrew.hendry@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-07 13:41:38 -08:00
..
af_x25.c X25 remove bkl in call user data length ioctl 2010-11-28 11:12:22 -08:00
Kconfig BKL: introduce CONFIG_BKL. 2010-10-21 15:44:13 +02:00
Makefile
sysctl_net_x25.c sysctl net: Remove unused binary sysctl code 2009-11-12 02:05:06 -08:00
x25_dev.c X25: Add if_x25.h and x25 to device identifiers 2010-04-22 16:12:36 -07:00
x25_facilities.c x25: possible skb leak on bad facilities 2011-02-07 13:41:38 -08:00
x25_forward.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
x25_in.c x25: possible skb leak on bad facilities 2011-02-07 13:41:38 -08:00
x25_link.c Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2010-12-08 13:47:38 -08:00
x25_out.c X25: Move interrupt flag to bitfield 2010-05-17 17:39:27 -07:00
x25_proc.c net: x25: use seq_list_foo() helpers 2010-02-10 11:12:10 -08:00
x25_route.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
x25_subr.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
x25_timer.c x25: Fix sleep from timer on socket destroy. 2009-06-16 05:40:30 -07:00